operator: Fix storing authentication credentials in the Loki ConfigMap

[periklis]

What this PR does / why we need it:
The following PR replaces all sensitive authentication information from the Loki configuration file by reading values from environment variables. Latter are projected from the object storage secret via EnvVar.ValueFrom source declaration.

Which issue(s) this PR fixes:
Fixes #

Special notes for your reviewer:

• The environment variables are projected into the ConfigMap cause of Loki's inability to leave the underlying SDKs reading their values instead of passing them via it's config.
• For testing on Azure you can consider using the scripts from this PR:
  • operator: Add tools to test on Azure #11340

Checklist

• Reviewed the CONTRIBUTING.md guide (required)
• Documentation added
• Tests updated
• CHANGELOG.md updated
  • If the change is worth mentioning in the release notes, add add-to-release-notes label
• Changes that require user attention or interaction to upgrade are documented in docs/sources/setup/upgrade/_index.md
• For Helm chart changes bump the Helm chart version in production/helm/loki/Chart.yaml and update production/helm/loki/CHANGELOG.md and production/helm/loki/README.md. Example PR
• If the change is deprecating or removing a configuration option, update the deprecated-config.yaml and deleted-config.yaml files respectively in the tools/deprecated-config-checker directory. Example PR

[github-actions]

Trivy scan found the following vulnerabilities:

• HIGH openssl: Incorrect cipher key and IV length processing in libcrypto3 v3.1.3-r0. Fixed in v3.1.4-r0
• HIGH openssl: Incorrect cipher key and IV length processing in libssl3 v3.1.3-r0. Fixed in v3.1.4-r0

[xperimental]

Looks good overall. Only tested it with S3 so far. Found a few typos, see comments.

[xperimental]

While testing today something occurred to me, that I did not think of yesterday:

This change makes the configuration file static with regards to some of the fields of the secret (the ones that are passed using environment variables now).
We currently pass an annotation containing the hash of the configuration file to all the deployments / statefulsets that we create, so that they automatically re-create their pods when the configuration changes. Because some fields of the secret now do not correspond to a change in the configuration file it can happen that a change to the secret does not trigger an update of the deployments/statefulsets anymore causing old configuration to persist in the Loki instances.

I guess a simple fix for this would be to take the contents of the secret into account when creating the "config-hash" as well. Adding a new annotation is also an alternative.

[xperimental]

Pod updates seem to work fine now 👍

One refactoring idea in the comments, looks fine for me otherwise.