Azure Key Vault integration to resolve secrets

[nikola-jokic]

This PR adds the ability to use Azure Key Vault when resolving GitHub secrets. It would be beneficial to users who don't want to use kuberenetes secrets with GitHub PAT or App credentials.

Other secrets, such as proxy credentials, listener configuration, and runner JIT tokens, are still stored as kubernetes secrets.

[Copilot]

Pull Request Overview

This PR integrates Azure Key Vault as a new source for GitHub App credentials and refactors related configuration and CRD definitions.

• Updated the config reading flow to support context and vault lookups.
• Refactored naming from GitHubServerTLSConfig to TLSConfig and introduced vaultConfig support in charts and CRDs.
• Added tests and updated error messages for vault configuration and app credentials validation.

Reviewed Changes

Copilot reviewed 48 out of 48 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
cmd/ghalistener/main.go	Updates to context management and usage of the new config reading API
cmd/ghalistener/config/config.go	Modified config reading to support vault integration and pointer usage
cmd/ghalistener/config/config_validation_test.go	Updated expected error strings and added vault config tests
cmd/ghalistener/config/config_client_test.go	Added AppConfig to client configuration tests
cmd/ghalistener/app/app.go	Changed to use pointer for config and added config validation
charts/gha-runner-scale-set/values.yaml	Revised secret and vault configuration documentation in values file
charts/gha-runner-scale-set/templates/autoscalingrunnerset.yaml	Introduced vaultConfig block and error handling for unsupported vault types
CRD files	Added vaultConfig fields to CRDs
apis/actions.github.com/v1alpha1/*	Updated TLSConfig naming, deepcopy methods, and accessor methods; updated AppConfig integration

Comments suppressed due to low confidence (1)

apis/actions.github.com/v1alpha1/ephemeralrunner_types.go:117

• Replacing the 'GitHubServerTLS' field with 'VaultConfig' in EphemeralRunnerSpec is inconsistent with the accessor method that expects a TLSConfig. This mismatch can lead to nil dereferences; please restore or correctly rename the field to maintain consistency.

-	GitHubServerTLS *GitHubServerTLSConfig `json:"githubServerTLS,omitempty"`