feat: readd cloud sql proxy credentials

in the future we should create services accounts per component and env.

this mr currently uses the existing secret in bitwarden, but creates a proper secret in gitlab with that value, so its easier to switch to "service-account per env and component"

the helm chart now deploys that secret together with the rest of the app