fix: cleanup orphaned secret mounts when removed from StackConfigPolicy

[pkoutsovasilis]

Summary

Fixes cleanup of orphaned secret mounts when removed from StackConfigPolicy. When a policy's secretMounts configuration is updated to remove secret references,
the copied secrets in the target Elasticsearch namespace are now automatically deleted.

Fixes #8921

Problem

When a StackConfigPolicy removes a secret reference from its secretMounts configuration, the copied secret remains in the target Elasticsearch namespace indefinitely, leading to resource accumulation and potential confusion.

Reproduction Steps (from issue #8921)

1. Create an Elasticsearch instance labeled env: test
2. Create a source secret in the elastic-system namespace
3. Create a StackConfigPolicy that references this secret via secretMounts
4. ECK copies the secret to the Elasticsearch namespace
5. Update the StackConfigPolicy to remove the secretMounts section
6. Bug: The copied secret persists in the Elasticsearch namespace indefinitely

Expected Behavior

When a secret reference is removed from a StackConfigPolicy's secretMounts, ECK should automatically delete the corresponding copied secret from the target namespace.

Solution

Added cleanupOrphanedSecretMounts() function that runs during policy reconciliation to:

1. List all secrets in the ES namespace that are soft-owned by the policy
2. Filter for secrets with the policy.k8s.elastic.co/source-secret-name annotation (identifies SecretMount-managed secrets)
3. Compare against the current secretMounts list in the policy spec
4. Delete secrets that are no longer referenced in the policy

[prodsecmachine]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.