fix: detect image pull secret StatefulSet changes

[GatewayJ]

Type of Change

• New Feature
• Bug Fix
• Documentation
• Performance Improvement
• Test/CI
• Refactor
• Other:

Related Issues

N/A

Summary of Changes

• Detect spec.imagePullSecret drift in existing Tenant StatefulSets by comparing PodSpec image_pull_secrets during update checks.
• Add unit coverage that verifies new_statefulset() renders tenant image pull secrets.
• Add unit coverage for adding, changing, and removing image pull secrets on existing StatefulSets.

Checklist

• I have read and followed the CONTRIBUTING.md guidelines
• Passed make pre-commit (fmt-check + clippy + test + console-lint + console-fmt-check)
• Added/updated necessary tests
• Documentation updated (if needed)
• CHANGELOG.md updated under [Unreleased] (if user-visible change)
• CI/CD passed (if applicable)

Impact

• Breaking change (CRD/API compatibility)
• Requires doc/config/deployment update
• Other impact: Existing Tenant StatefulSets now reconcile when spec.imagePullSecret is added, changed, or removed.

Verification

cargo test image_pull_secret --lib -- --nocapture
make pre-commit

Additional Notes

• No CHANGELOG.md exists in this repository.
• CI is pending GitHub execution after PR creation.

---

Thank you for your contribution! Please ensure your PR follows the community standards (CODE_OF_CONDUCT.md) and sign the CLA if this is your first contribution.