Expose CI secrets in API response

Note: Do not merge until !34896 (merged) is merged

What does this MR do?

This MR is part of series of dependent MRs extracted from !33231 (closed) in order to split work in smaller chunks:

• Add column to ci_builds_metadata to store secrets !34480 (merged)
  • ci_secrets_management feature check !34587 (merged)
    • Add check for "secrets" runner feature !34813 (merged)
      • Yaml processing and saving secrets configuration in DB !34896 (merged)
        • (this MR) Expose secrets configuration in API response !34898 (merged)

It builds on top of !34896 (merged) and updates /api/v4/jobs/request endpoint to include CI secrets configuration if job has any and the feature is available.

Vault server details (url and auth role) should be provided as CI variables (VAULT_SERVER_URL and VAULT_AUTH_ROLE). The plan is to move these to DB and UI in the next iteration - #218677.

This MR does not handle the case when the above CI variables are missing, we just pass the details to the runner as is. I'll submit another MR that handle this case and fails the job as proposed in #218746 (comment 351070788).

Related to #28321 (closed) and #218746 (closed).

Screenshots

Does this MR meet the acceptance criteria?

Conformity

• Changelog entry
• Documentation (if required)
• Code review guidelines
• Merge request performance guidelines
• Style guides
• Database guides
• Separation of EE specific content

Availability and Testing

• Review and add/update tests for this feature/bug. Consider all test levels. See the Test Planning Process.
• Tested in all supported browsers
• Informed Infrastructure department of a default or new setting change, if applicable per definition of done

Security

If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:

• Label as security and @ mention @gitlab-com/gl-security/appsec
• The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
• Security reports checked/validated by a reviewer from the AppSec team