[patch] remove ibm_entitlement_key from Tekton param flow and source from secrets

[jigneshchauhan2001]

Summary

ibm_entitlement_key was appearing as plaintext in pod environment variables and being passed through MAS install/restore PipelineRuns into pod specs via tekton parameters.
This change removes ibm_entitlement_key from the Tekton parameter flow and updates all affected task pods under /tekton/src/tasks to read IBM_ENTITLEMENT_KEY directly from the Kubernetes secret pipeline-additional-configs via secretKeyRef. It also extends the mas-restore pipeline to carry the shared-additional-configs workspace so the restore flow has the same secret access as install.
It also applies the SLS speific-fix in /cli/tekton/src/tasks/dependencies/sls.yml.j2 so IBM_ENTITLEMENT_KEY is not injected into the SLS pod for newer SLS channel paths (sls_channel > 3.7.0).

Changes

Removed ibm_entitlement_key param from PipelineRuns from templates under src/mas/devops/templates/.
/src/mas/devops/tekton.py updated to write secret:
prepareInstallSecrets() - updated to writeIBM_ENTITLEMENT_KEY into pipeline-additional-configs secret when provided
prepareRestoreSecrets() - same behaviour as prepareInstallSecrets() for the restore pipeline flow; creates pipeline-additional-configs secret in the target namespace.
Added shared-additional-configs workspace binding (backed bypipeline-additional-configs secret) to /src/mas/devops/templates/pipelinerun-aiservice-upgrade.yml.j2.
Added shared-additional-configs workspace binding to /src/mas/devops/templates/pipelinerun-restore.yml.j2.

Validation

Validation details are attached in
MAS-Core-Manage-PFVT-Cluster-Validations.docx for cluster and PFVT validations.
AIService-PFVT-Cluster-Validations.docx for cluster and PFVT validations.
Both files contain OC CLI validations and OpenShift UI validations confirming:

• PipelineRuns do not contain ibm_entitlement_key as a parameter
• Secret pipeline-additional-configs contains IBM_ENTITLEMENT_KEY
• All affected pods use valueFrom.secretKeyRef - no plaintext value
• No pod YAML contains the old lowercase ibm_entitlement_key param name

Validated on Fyre OCP cluster:

• Install pipeline for MASCore/Manage completed.
• fvt-core completed successfully.
• fvt-manage completed successfully.
• Install pipeline for AIService completed.

FVT results:
MASCore: https://dashboard.ibmmas.com/tests/fixsecurity/3291
AIService: https://dashboard.ibmmas.com/tests/fixsecurity/3305