IBAC judge bearer token rendered into ConfigMap (plaintext) — use secretKeyRef #525

Summary

The IBAC judge bearer token (defaults.ibac.judgeBearer, plumbed via the new platform IBACConfig) is rendered inline into the per-agent authbridge-config-<name> ConfigMap as part of the ibac plugin config. A ConfigMap is plaintext-at-rest and readable by anyone with namespace get configmap — a much more broadly-granted RBAC verb than get secret. It also flows into etcd (unencrypted by default), GitOps diffs, cluster backups, and kubectl -o yaml output/logs.

Introduced in #524 (AuthBridge layer-3 preset rendering).

Why this matters

The rest of that ConfigMap (jwt-validation issuer, keycloak URLs, token-exchange identity, outbound routes) is legitimately non-secret configuration — the bearer is the lone credential in an otherwise-appropriate config blob. Today the field is frequently empty (judge auth isn't always required), so the exposure is currently latent — but that's a trap: a plaintext path invites someone to populate a real token later without realizing where it lands.

Proposed fix

Source the judge bearer from a Secret via secretKeyRef rather than inlining it into the ConfigMap. Note this is not an operator-only change: the AuthBridge sidecar reads its config inline from the mounted config.yaml, so it must be taught to source that one field from a mounted Secret / env var (e.g. env interpolation in config, or a projected Secret merged at mount). That coordinated operator + authbridge-plugin change is why this was scoped as a follow-up rather than folded into #524.

Priority

Should land before the bearer is populated with a real token in any live deployment.

Raised as a non-blocking review suggestion by @cwiklik on #524.