auth: support nodePublishSecretRef

[tam7t]

Allows the pod definition to specify a K8S secret that the CSI driver should use when authenticating to GCP:

      volumes:
        - name: secrets-store-inline
          csi:
            driver: secrets-store.csi.k8s.io
            readOnly: true
            volumeAttributes:
              secretProviderClass: "gcp-sync"
            nodePublishSecretRef:
              name: secrets-store-creds

The Secret should be an exported SA credential:

gcloud iam service-accounts keys create OUTPUT-FILE --iam-account=IAM_ACCOUNT

and loaded like:

kubectl create secret generic secrets-store-creds --from-file=key.json=PATH-TO-KEY-FILE.json

This will be used when creating kind integration tests that may not run in an environment where workload identity or GCE instance metadata is available.