Azure DevOps orchestratorPAT as KeyVault reference instead of supplied as a hardcoded string

[pareion]

Description

When creating the HelmRelease for the GitOps Connector and if you're using Azure DevOps, you have to supply an orchestratorPAT for the GitOps Connector to change the status of the deployment on the commits and for it to make a callback afterwards.

However, having the token in the code is a security issue, as everybody with access to the repository can now get the orchestratorPAT and potentially do anything that the token can do.

This could be secured by supplying a KeyVault reference with the secret name to the HelmRelease instead of providing the hardcoded token.

Optional: If you also use Workload Identity Federation you also need a service account. It would be extra swell if you could supply the service account along with the KeyVault and secret name.