feat: support repository auth modes in ExternalSecret helper

[Matthiator]

Review order: This PR is stacked on #388. Please review and merge #388 first; this PR should be reviewed as the follow-up diff on top of that branch.

📝 Summary

Adds authMode-aware rendering to the Argo CD repository ExternalSecret helper so additional app repositories can use HTTPS, SSH deploy key, or GitHub App credentials.

HTTPS remains the default behavior, so existing remoteRef + PAT/password values keep rendering the same repository Secret fields. The Argo CD app repository documentation now includes vault and values.yaml examples for all three modes.

🧩 Type of change

• 🔧 CLI / Go code
• 📦 Helm chart
• 🧱 Terraform module
• 📝 Documentation
• 🧪 Test or CI change
• ♻️ Refactor / cleanup

⚠️ Is this a breaking change?

• Yes, this change breaks existing functionality (explain in summary)

🧪 Testing

• CI passed
• Manually tested (local/dev cluster)
• Unit tested
• Not tested (explain why below)

Validated locally with:

• cd src && make test
• make docs-build
• git diff --check
• helm dependency build /tmp/kubara-repo-helper-chart
• helm template for HTTPS, SSH, and GitHub App repository examples
• helm template failure check for missing GitHub App ID

🔗 Related Issues / Tickets

Related to #246

Stacked on #388.

✅ Checklist

• Code compiles and passes all tests
• Linting and style checks pass
• Comments added for complex logic (not needed)
• Documentation updated (if applicable)

📎 Additional Context (optional)

This follows the bootstrap repository auth-mode work by extending the same credential modes to the reusable ExternalSecret helper for additional Argo CD app repositories.