Add defender.existingSecret so defender-only certificates need not pass through Helm values

Summary

• In defender-only mode the chart wraps all nine defender.secrets values in required(), so the release cannot template without the certificate material.
• The only way to supply that material is Helm values, which forces a SOPS valuesFrom on the HelmRelease.
• CI cannot decrypt that valuesFrom, so the release is excluded from render validation.

Impact

• Every defender-only cluster carries a render waiver instead of validation.
• Certificate material passes through Helm values and lands in the release storage Secret.
• The SSO path already supports a pre-created Secret; the defender path is the outlier.

Proposed resolution

• Add defender.existingSecret naming a pre-created Secret with the nine mounted files.
• When set, render no defender Secret and mount the named one on the DaemonSet.
• Keep the required() guards for the values path so a missing certificate still fails loud.