fix: exclude extraSecrets from KbsConfig on Azure to match pull-secret-credential-policy

[butler54]

Problem

On Azure, the KBS deployment fails with:

Error in creating/updating KBS deployment {"kbsconfig": "trustee-operator-system", "err": "Secret \"credential\" not found"}

Root cause: templates/kbs.yaml unconditionally lists kbs.extraSecrets
(default: ["credential"]) in KbsConfig.spec.kbsSecretResources. But
templates/pull-secret-credential-policy.yaml — the ACM
ConfigurationPolicy that creates the credential Secret from the
cluster's openshift-config/pull-secret — is explicitly (and correctly)
skipped on Azure, since peer-pod CDH doesn't fetch registry credentials via
KBS. Nothing kept KbsConfig's secret list in sync with that exclusion.

Fix

Gate the extraSecrets range in templates/kbs.yaml with the same
condition used by pull-secret-credential-policy.yaml:

{{- if and (eq .Values.global.coco.secured true) (ne .Values.global.clusterPlatform "Azure") }}
{{- range .Values.kbs.extraSecrets }}
- "{{ . }}"
{{- end }}
{{- end }}

Bare metal and other non-Azure platforms are unaffected — extraSecrets
(credential) is still included there, matching existing behavior.

(Note: an earlier revision of this PR took the opposite approach — making
the credential policy unconditional so the secret would exist everywhere.
That was reverted after confirming on a live Azure cluster that
sandboxed-policies-chart's pull-secret-distribution mechanism
(per-namespace pull-secret Secret + default ServiceAccount
imagePullSecrets patch) is already deployed and working there, making the
KBS-based credential resource genuinely redundant on Azure, not just
theoretically unused.)

Verification

helm template / helm lint against a clean checkout of this branch:

• global.clusterPlatform=Azure, global.coco.secured=true → kbsSecretResources excludes "credential"; pull-secret-credential-policy does not render.
• global.clusterPlatform=BareMetal, global.coco.secured=true → kbsSecretResources still includes "credential" (unchanged); policy still renders.
• helm lint . passes.

Confirmed on a live Azure cluster (sandbox-policies ArgoCD app Synced/Healthy) that pull-secret Secrets and patched default ServiceAccounts already exist in workload namespaces (hello-openshift, kbs-access), independent of KBS.