[Puma] token from secret management with ENC[token-key] notation failed

[LucasBoisserie]

Describe the results you received:
puma integration is configure with a pod annotation:

"control_url":"http://%%host%%:%%port_puma%%/stats?token=ENC[k8s_secret@default/secret/PUMA_CONTROL_TOKEN]"

output in datadog agent logs:

puma (1.2.1)
    ------------
      Instance ID: puma:850dc162439322e8 [ERROR]
      Configuration Source: container:containerd://1992b9f0e438421448485cf59e6d2f4776b2466d6b25c5ef4952c9418c69e3e7
      Total Runs: 4
      Metric Samples: Last Run: 0, Total: 0
      Events: Last Run: 0, Total: 0
      Service Checks: Last Run: 1, Total: 4
      Average Execution Time : 12ms
      Last Execution Date : 2024-03-06 20:13:52 UTC (1709756032000)
      Last Successful Execution Date : Never
      Error: 403 Client Error: Forbidden for url: http://10.143.1.89:********@default/secret/PUMA_CONTROL_TOKEN%5D
      Traceback (most recent call last):
        File "/opt/datadog-agent/embedded/lib/python3.9/site-packages/datadog_checks/base/checks/base.py", line 1235, in run
          self.check(instance)
        File "/opt/datadog-agent/embedded/lib/python3.9/site-packages/datadog_checks/puma/puma.py", line 24, in check
          response, content_type, version = self._perform_service_check(instance, control_url)
        File "/opt/datadog-agent/embedded/lib/python3.9/site-packages/datadog_checks/puma/puma.py", line 72, in _perform_service_check
          request = self._perform_request(url)
        File "/opt/datadog-agent/embedded/lib/python3.9/site-packages/datadog_checks/puma/puma.py", line 84, in _perform_request
          request.raise_for_status()
        File "/opt/datadog-agent/embedded/lib/python3.9/site-packages/requests/models.py", line 1021, in raise_for_status
          raise HTTPError(http_error_msg, response=self)
      requests.exceptions.HTTPError: 403 Client Error: Forbidden for url: http://10.143.1.89:********@default/secret/PUMA_CONTROL_TOKEN%5D

Additional environment details (Operating System, Cloud provider, etc):
GCP, GKE 1.27 with container optimized OS, datadog-agent: 7.50.3

Describe the results you expected:
Secret injected by agent

Additional information you deem important (e.g. issue happens only occasionally):
After discussion with datadog support, secret injection with notation ENC[token-key] it's not possible in the middle of field (like control_url. It has to be the whole field. But when we are on Kubernetes we have to use %%host%% to have dynamically the container address.
To have a compatibility with secret management, it can be good to have a dedicated field for token like others integrations (postgres, elasticsearch). What do you think ? (I can help to do the Pull Request if needed)