Enable agent image pull secrets propagation to be disabled

[weyfonk]

#5050 allowed image pull secrets to be referenced for both Fleet controller and agent deployments.
Fleet propagates referenced image pull secrets to all downstream clusters.

However, in some cases involving Fleet in Rancher, distinct sets of image pull secrets may need to be referenced for different downstream clusters, which the current Fleet implementation does not cover.

Suggested solution: Fleet Cluster objects could support a new agentPullSecrets field, which would override Fleet's global.cattle.imagePullSecrets Helm value when both are non-nil.
Rancher controllers already propagate image pull secrets through rancher/rancher#54180 (see rancher/rancher#55071), meaning that in this case, Fleet's propagation of such secrets needs to be disabled.

[weyfonk]

Additional QA

Problem

Fleet only supported image pull secrets, needed by agent deployments, to be specified globally, through Helm value global.cattle.imagePullSecrets. This meant that all agents, regardless of the downstream cluster where they live, would receive the same set of image pull secrets. However, different image registries may be available depending on downstream clusters, which justifies configuring image pull secrets by cluster in some cases.

Solution

Fleet Cluster resources now support a new agentPullSecrets field which, when specified, overrides the global.cattle.imagePullSecrets value.
When a cluster's agentPullSecrets is specified, Fleet's agent management controller does not propagate those secrets to the corresponding downstream cluster, because Rancher is then expected to handle that propagation.

Testing

Engineering Testing

Manual Testing

N/A (focused on automated testing in the interest of time)

Automated Testing

Unit tests validating that image pull secrets are added to the set of Kubernetes resources created by Fleet's agent management controller, along with agent deployments, and referenced by said deployments, depending on whether propagation of image pull secrets is enabled (which is computed separately, resolving to true if only global image pull secrets are configured, false otherwise):

Global image pull secrets configured?	Cluster-level secrets configured?	Image pull secrets created downstream?	Image pull secrets referenced by Fleet agent deployment?	Observations
✅	❌	✅	✅
✅	✅	❌	✅	Secrets (coming from the Cluster resource) must still be referenced by the deployment to be used
✅	✅ (explicit empty value)	❌	❌	An empty cluster-level set of secrets means no secrets should be used
❌	❌	❌	❌

QA Testing Considerations

This needs manual testing:

• cluster-level agentPullSecrets override global.cattle.imagePullSecrets values if both are specified
  • in that case, secrets referenced by global.cattle.imagePullSecrets should not be propagated to the corresponding downstream cluster
• when no cluster-level agentPullSecrets is specified for a given cluster, secrets referenced by global.cattle.imagePullSecrets should be used instead, if any.

Regressions Considerations

Specifying only global image pull secrets and no cluster-level agentPullSecrets should still work as it previously did: global image pull secrets should be propagated to all downstream clusters for agents to be able to use them.