feat(controller): reconcile BMCSecret on credential rotation

[defo89]

Summary

Fixes #159

Previously, createBmcSecret only created BMCSecrets — if one already existed it returned early without comparing or updating credentials. When IPMI credentials rotate in Vault, BMCSecrets on the metal cluster became stale.

Changes

• api/v1alpha1/common.go: Add AnnotationIgnore = "argora.cloud.sap/ignore" constant
• internal/controller/ironcore_controller.go: reconcileBmcSecret now does Get → annotation check → CreateOrUpdate. Returns (secret, skipped, error) — caller skips patchOwnerReference when ignored.
• internal/controller/metal3_controller.go: Convert createBmcSecret → reconcileBmcSecret using controllerutil.CreateOrUpdate. Same ignore annotation support as ironcore.
• Tests: credential rotation, no-op on unchanged credentials, label updates, ignore annotation skip, owner reference skip

Ignore Annotation

argora.cloud.sap/ignore: "true" on a BMCSecret prevents all controller writes to that resource (no data update, no label update, no owner ref patch). The controller still reads the resource to pass .Name to BMC's BMCSecretRef.

[github-actions]

Merging this branch will increase overall coverage

Impacted Packages	Coverage Δ	🤖
github.com/sapcc/argora/api/v1alpha1	26.57% (ø)
github.com/sapcc/argora/internal/controller	85.66% (+0.97%)	👍

---

Coverage by file

Changed files (no unit tests)

Changed File	Coverage Δ	Total	Covered	Missed	🤖
github.com/sapcc/argora/api/v1alpha1/common.go	0.00% (ø)	0	0	0
github.com/sapcc/argora/internal/controller/constants.go	0.00% (ø)	0	0	0
github.com/sapcc/argora/internal/controller/ipupdate_controller.go	89.91% (ø)	228	205	23
github.com/sapcc/argora/internal/controller/ironcore_controller.go	86.16% (+3.95%)	159 (-4)	137 (+3)	22 (-7)	👍
github.com/sapcc/argora/internal/controller/metal3_controller.go	76.27% (+1.57%)	177 (+11)	135 (+11)	42	👍
github.com/sapcc/argora/internal/controller/update_controller.go	89.40% (ø)	151	135	16

Please note that the "Total", "Covered", and "Missed" counts above refer to code statements instead of lines of code. The value in brackets refers to the test coverage of that file in the old version of the code.

Changed unit test files

• github.com/sapcc/argora/internal/controller/ironcore_controller_test.go
• github.com/sapcc/argora/internal/controller/metal3_controller_test.go