New secrets provider: GCP Secret Manager

Google Cloud Secret Manager is now a native secret provider. Use gcp://secret-name with Application Default Credentials, service account keys, or Workload Identity on GKE — no wrapper scripts needed.