feat(secrets): add unified Bitwarden secret runner

[zdrapela]

What

• Add a provider-neutral secrets export with profile parsing, collection mapping, Bitwarden access, environment materialization, and child-process execution.
• Add the rhdh-e2e-secrets exec CLI for running commands with selected secrets.
• Require an already unlocked Bitwarden session and use the locally installed bw executable.
• Validate readable collections and explicitly deny the AWS credentials collection.
• Preserve the existing VAULT_* environment naming contract through profile transforms.
• Add unit/integration coverage and documentation for local secret execution.
• Release the package as 2.3.0.

Why the locally installed bw CLI

The runner invokes the locally installed Bitwarden bw executable instead of adding the NPM @bitwarden/cli package. The NPM CLI requires a specific Node.js version, which would conflict with Node.js versions selected by the E2E toolchain and CI and would add unnecessary runtime coupling to every consumer. Using the external CLI keeps the package dependency graph stable while allowing the same secret-management flow to be used by both rhdh-plugin-export-overlays and rhdh.

The runner does not log in, unlock, lock, or persist the Bitwarden session. It only uses the existing BW_SESSION value and the installed CLI.

Consumer

The corresponding overlay integration is in rhdh-plugin-export-overlays#3565.

This package is intended to be the shared secret-management tool for E2E execution across both rhdh-plugin-export-overlays and rhdh repositories.

Validation

• yarn build && yarn test: 157 passed, 0 failed.
• yarn check: passed with 0 errors and 18 existing lint warnings in plugin-metadata test files.
• Local Bitwarden process isolation and secret materialization checks passed.

Dependency

The overlay consumer must wait for the 2.3.0 package release before registry-based installs can resolve it.