feat: adapt secret resolver for customization

[betinacosta]

Description

This is the first of a series of PRs. I started by doing changes to secret resolver. I tested the changes using the destination module, but I will only modify the modules usage of secret resolver later.

Refactors the secret resolver module to expose a composable, class-based API alongside the existing legacy function. Users can now wire a custom resolver chain once at application startup via configure(SdkConfig(resolver=...)) and all create_client() calls across modules will use it automatically. The built-in MountResolver and EnvVarResolver classes implement the Resolver protocol, and ChainedResolver tries each in order — providing a clear extension point for custom sources (e.g. VCAP_SERVICES, HashiCorp Vault).

The legacy read_from_mount_and_fallback_to_env_var function is preserved for backwards compatibility. Internally it now delegates to the same MountResolver/EnvVarResolver implementations.

Related Issue

Closes #

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Code refactoring
• Dependency update

How to Test

Run the unit test suite: pytest tests/core/unit/secret_resolver/

Checklist

• I have read the Contributing Guidelines
• I have verified that my changes solve the issue
• I have added/updated automated tests to cover my changes
• All tests pass locally
• I have verified that my code follows the Code Guidelines
• I have updated documentation (if applicable)
• I have added type hints for all public APIs
• My code does not contain sensitive information (credentials, tokens, etc.)
• I have followed Conventional Commits for commit messages

[betinacosta]

The idea is to remove this file later, when all modules start using the new secret resolver