fix(metal3): reconcile BMCSecret for existing BareMetalHosts

[defo89]

Problem

The metal3 controller's reconcileDevice returned early when a BareMetalHost already existed, skipping reconcileBmcSecret entirely. This meant:

• Credential rotation from credentials.json was never applied to existing devices
• Manual edits to BMC secrets were never corrected

Fix

1. Move reconcileBmcSecret before BMH existence check — secrets are now always reconciled regardless of whether the BMH already exists (matching the ironcore controller pattern)
2. Use Data instead of StringData — StringData is write-only (never returned by the API), causing CreateOrUpdate to issue spurious updates every reconcile cycle. Using Data directly allows proper equality comparison, updating only when credentials actually change.

[github-actions]

Merging this branch will not change overall coverage

Impacted Packages	Coverage Δ	🤖
github.com/sapcc/argora/internal/controller	86.02% (ø)

---

Coverage by file

Changed files (no unit tests)

Changed File	Coverage Δ	Total	Covered	Missed	🤖
github.com/sapcc/argora/internal/controller/metal3_controller.go	76.27% (ø)	177	135	42

Please note that the "Total", "Covered", and "Missed" counts above refer to code statements instead of lines of code. The value in brackets refers to the test coverage of that file in the old version of the code.

[goerangudat]

lgtm