Goal:

Enable service operators to consume Keystone ApplicationCredentials  instead of static passwords, and automatically roll pods when those credentials rotate.

•  Service controllers watches and read the AC CR
•  Fetch the AC oc secret (ID+SECRET), verify it, and render it to the pod
• Compute the secret-hash and trigger a rolling restart when it changes
• Fall back to password-based auth only if no AC Secret is configured
• In those operators that manages services that need AC on dataplane implement dataplane support, see Jira - https://issues.redhat.com/browse/OSPRH-14740

Acceptance Criteria:

• Proper reconciliation logic
• Functional/kuttl tests

Open questions: