currently credentials can come from artemis cr, security cr or secret.

these three options should be exclusive, one is sufficient and we don't want to track back and forth - especially when a user can supply the secret.

we may also want to deprecate all save the secret, since only secret has some level of security.

note: longer term, the intent is that the operator will use a service account for broker access.