Allow fetching deploy key from external secret provider

[saua]

I'm currently in the process of setting up fully automated Flatcar VMs with doco-cd deploying stuff and pulling its secrets from OpenBAO. It's all working neatly so far, but from what I've seen doco-cd can't pull the secrets it needs for fetching the git repo from the secret provider that's configured. Right now I've got a service that does that for doco-cd, but I really think that would be a neat feature, making doco-cd depend on exactly one set of credentials for the external secret provider and everything else gets pulled automagically.

[kimdre]

I feel like this is a hen egg problem, because I think lots of people would use doco-cd to also deploy the OpenBao instance.
You can however do this with two doco-cd instances that manage each other, similiar to the self-updating setup.