Reintroduce "move grafana additional sources from configmap to secret to avoid password leak"

this reintroduces !5815 (merged) which had been reverted by !6062 (merged)

as #3149 (closed) has now been solved with !6021 (merged)

closes #2875