AIAP: support non test GPG keys

[jgu17]

Problem description (if applicable)

AIAP can only deploy using the Mozilla SOPS gpg key for testing purpose.

Proposed change
Add support in AIAP to use a production gpg key for secret encryption and decryption.

Potential impacts
Potential security or performance related impacts.

[sirajyasin]

I can work on this issue if no one has started yet. Can someone assign this issue to me ?

[sreejithpunnapuzha]

All yours @sirajyasin

[mattmceuen]

Thanks @sirajyasin ! A couple thoughts on how to approach it:

1. make this line conditional, based on an input/override to AIAP: https://github.com/airshipit/airshipctl/blob/master/tools/airship-in-a-pod/runner/assets/entrypoint.sh#L77
   This^ is because we still want to regenerate/show secrets in our gates, but when we're testing an integration that uses real-life credentials in the manifests, we want to neither regenerate nor show!

2. provide the decryption key to AIAP via a kind: Secret. The base kustomization could define the contents of this to include the mozilla key, and there could be a placeholder and/or documentation on how to kustomize a real key on top of it

3. add documentation on how to use a custom key to the AIAP README

4. (probably outside the scope of this issue, & should be a follow-on) it would be great to leverage airshipctl document validate #2 to mount in azure key vault-hosted keys, perhaps using this feature: https://docs.microsoft.com/en-us/azure/aks/csi-secrets-store-driver

[sirajyasin]

This Issue can be marked completed/Closed. Both the related PSs are merged now.

[eak13]

closing per merge