scheduler: move auth data to a secret

Closes: #1705 (closed)

See the referenced issue for more details. Tested manually.

I will be working on a followup MR that introduces reloader into scheduler controller, so that changes to auth (e.g. rotating credentials) "simply work" for the user, instead of them having to know to bounce the gatekeeper.