Support existing secret for the full external DB connection

[tada5hi]

Closes #2381.

Revives the change from #1783 (closed unmerged), rebased on current main.

What

Today, with an external database, only the password can be read from database.external.existingSecret (with the key hardcoded to password); host, port, username and coreDatabase must be plaintext values. This PR turns existingSecret into an object so the whole connection can come from one secret, with configurable key names:

database:
  external:
    existingSecret:
      enabled: false
      name: "my-external-secret-name"
      keys:
        host: host
        port: port
        username: username
        password: password
        coreDatabase: dbName

• When enabled: true: core (deployment + pre-upgrade job) and exporter source POSTGRESQL_HOST/PORT/USERNAME/PASSWORD/DATABASE from the referenced secret via secretKeyRef, and core-cm / core-secret / exporter-cm-env / exporter-secret skip emitting the plaintext values.
• When enabled: false: behaviour is unchanged (backward compatible).

Testing

• helm lint → 0 failed.
• helm template with database.type=external and database.external.existingSecret.enabled=true renders all five connection variables from the referenced secret on both core and exporter; with it disabled, the rendered output matches main.