Add ArgoCD Applications for External Secrets Operator and OpenBao

- external-secrets: deployed directly from its official Helm repo with
  installCRDs enabled.
- openbao: deployed from the new openbao-gitops repo, providing the
  ClusterSecretStore that binds ESO to OpenBao.

Also extends templates/application.yaml to support Helm-repo sources
(source.chart) in addition to git path-based sources, and raw Helm
values blocks.

Co-authored-by: Copilot <[email protected]>

values.yaml

@@ -32,3 +32,41 @@ applications:
         selfHeal: true
       syncOptions:
         - CreateNamespace=true
+
+  # External Secrets Operator - installed straight from its official Helm
+  # repo (no git source needed). CRDs are installed by the chart itself.
+  - name: external-secrets
+    enabled: true
+    source:
+      repoURL: https://charts.external-secrets.io
+      chart: external-secrets
+      targetRevision: "2.10.0"
+      helm:
+        values: |
+          installCRDs: true
+    destination:
+      server: https://kubernetes.default.svc
+      namespace: external-secrets
+    syncPolicy:
+      automated:
+        prune: true
+        selfHeal: true
+      syncOptions:
+        - CreateNamespace=true
+
+  # OpenBao secret management backend + its ClusterSecretStore binding for ESO.
+  - name: openbao
+    enabled: true
+    source:
+      repoURL: https://git.smokyzone.de/SmokyZone/openbao-gitops.git
+      targetRevision: main
+      path: .
+    destination:
+      server: https://kubernetes.default.svc
+      namespace: openbao
+    syncPolicy:
+      automated:
+        prune: true
+        selfHeal: true
+      syncOptions:
+        - CreateNamespace=true