feat: support Helm custom value secret refs

[vigneshrajsb]

Summary

• Add secret-ref-preserving Mustache rendering shared by env/initEnv and Helm custom values.
• Parse native Helm custom values after merge precedence, converting full-value secret refs into mounted Secret files consumed with --set-file.
• Combine env, initEnv, and Helm value secret refs into one strict native Helm secret-processing path with a fresh sync token.
• Reject Helm custom value secret refs on Codefresh deploy paths and reject --debug/--dry-run native Helm args when secret set-files are present.