Support restricting secrets resolution to subset of config repositories

Summary

Currently if you allow a secret configuration to be used by all entity types with Allow / * / * it is possible to refer to secrets within a config repository material (and have "test connection" resolve the secret). You can also Deny to all with a fallback Deny / * / * rule.

However you seemingly cannot restrict a subset of config repositories that can refer to a subset of secrets for use in their materials.

Note that this is a separate concern to materials defined pipelines inside config repos; whose permissions are correctly derived from the pipeline group.

Motivation / Use Case

It'd improve granularity of permissions for the ConfigRepo to be a SupportedEntity for secrets resolution. Only the material password field seems relevant for interpolation right now.

Proposal

• Add ConfigRepos as a SupportedEntity
• Allow to be configured on the Secrets UI
• Change the AbstractMaterialTestController to specifically handle config repo connection tests (in this case pipelineGroup will be blank/unset).
• Check the validation via the config repo modification API; and whatever runtime validation is in place when constructing and polling the material.
• Update documentation

Any other info

Note that #13232 may be relevant, as it seemed to make this possible at runtime.