mbp-951: Add spiffe-vault-client to qtodo app

[mlorenzofr]

This PR adds a new sidecar container (spiffe-vault-client) to qtodo app.

A Python script running inside this container will:

1. connect to the Vault service (using the cluster svc address and TLS)
2. retrieve a Vault client token using the SPIFFE jwt.token generated by the spiffe-helper container
3. get the qtodo database credentials
4. dump the credentials into a properties file

Perhaps we could build an image instead of creating the script on the fly. This would improve the startup process.

The script can be configured using the following environment variables:

• VAULT_URL
• VAULT_ROLE
• VAULT_SECRET_PATH
• DB_USERNAME
• CREDENTIALS_FILE

I set up the Chart template to configure these variables using the values-hub.yaml file.

Here is an example of spiffe-vault-client logs:

2025-08-28 15:59:07,210 - INFO - Initialized VaultCredentialManager with:
2025-08-28 15:59:07,210 - INFO -   VAULT_URL: https://vault.vault.svc.cluster.local:8200
2025-08-28 15:59:07,210 - INFO -   VAULT_SECRET_PATH: secret/data/global/qtodo
2025-08-28 15:59:07,210 - INFO -   VAULT_ROLE: dev
2025-08-28 15:59:07,210 - INFO - Starting Vault credential manager
2025-08-28 15:59:07,210 - ERROR - Failed to retrieve SPIFFE token: [Errno 2] No such file or directory: '/svids/jwt.token'
2025-08-28 15:59:07,210 - ERROR - Vault authentication error: [Errno 2] No such file or directory: '/svids/jwt.token'
2025-08-28 15:59:07,210 - ERROR - Error in main loop: [Errno 2] No such file or directory: '/svids/jwt.token'
2025-08-28 15:59:07,210 - INFO - Retrying in 60 seconds...
2025-08-28 16:00:07,211 - INFO - Successfully retrieved SPIFFE JWT token
2025-08-28 16:00:07,211 - INFO - Authenticating with Vault
2025-08-28 16:00:07,235 - INFO - Successfully authenticated with Vault
2025-08-28 16:00:07,235 - INFO - Token lease duration: 3600 seconds
2025-08-28 16:00:07,235 - INFO - Retrieving secret from Vault
2025-08-28 16:00:07,249 - INFO - Successfully retrieved secret from Vault
2025-08-28 16:00:07,249 - INFO - Extracted 1 credential(s)
2025-08-28 16:00:07,250 - INFO - Credentials written to /run/secrets/db-credentials/credentials.properties
2025-08-28 16:00:07,250 - INFO - Sleeping for 1800 seconds before next check

And this is the result in qtodo app container:

$ oc exec -ti -n qtodo qtodo-674dfc5dcd-d8fw4 -c qtodo -- cat /run/secrets/db-credentials/credentials.properties
# Generated credentials from Vault
# Generated at: 2025-08-28T16:00:07.250004

quarkus.datasource.username=qtodo_user
quarkus.datasource.password=secret-password

[mlorenzofr]

@posip-redhat @sabre1041

[ghost]

Was advocating creation of sidecar container image and push to quay. Slack discussion is on using base python ubi and injecting python code via CM

[sabre1041]

First batch of suggestions

[mlorenzofr]

First batch of suggestions

Thanks for the review @sabre1041 ! 🙏
I've implemented all the suggestions, please review them when possible

[sabre1041]

LGTM

Requires #33 to be integrated first