Abstract out secrets as paths from tenant.yaml

[kakkoyun]

Tenants.yaml needs to be a secret because it contains secret values, namely oauth client secret. It'd make life easier to abstracted out secrets as paths from tenant.yaml when we want to rotate OAuth secrets per tenant.

Allow setting the cert private key and other secrets either directly or with a path, we could provide a field to set OAuth client secrets using a path here https://github.com/observatorium/observatorium/blob/master/main.go#L134.