move secrets from sops lookup plugin to sops vars plugin

This makes secret configuration and usage a good bit cleaner.

resources/chaosknoten/grafana/docker_compose/alertmanager.yaml.j2

@@ -34,7 +34,7 @@ receivers:
   - name: "ccchh-infrastructure-alerts"
     telegram_configs:
       - send_resolved: true
-        bot_token: {{ lookup("community.sops.sops", "resources/chaosknoten/grafana/secrets.yaml", extract="['alertmanager_telegram_bot_token']") }}
+        bot_token: {{ secret__alertmanager_telegram_bot_token }}
         chat_id: -1002434372415
         parse_mode: HTML
         message: {{ "'{{ template \"alert-message.telegram.ccchh\" . }}'" }}

resources/chaosknoten/grafana/docker_compose/compose.yaml.j2

@@ -36,7 +36,7 @@ services:
     restart: unless-stopped
     environment:
       - GF_SECURITY_ADMIN_USER=admin
-      - "GF_SECURITY_ADMIN_PASSWORD={{ lookup("community.sops.sops", "resources/chaosknoten/grafana/secrets.yaml", extract="['GF_SECURITY_ADMIN_PASSWORD']") }}"
+      - "GF_SECURITY_ADMIN_PASSWORD={{ secret__grafana_gf_security_admin_password }}"
     volumes:
       - ./configs/grafana.ini:/etc/grafana/grafana.ini
       - ./configs/grafana-datasource.yml:/etc/grafana/provisioning/datasources/datasource.yml
@@ -50,7 +50,7 @@ services:
     restart: unless-stopped
     environment:
       - PVE_USER=grafana@pve
-      - "PVE_PASSWORD={{ lookup("community.sops.sops",  "resources/chaosknoten/grafana/secrets.yaml", extract="['prometheus-exporter']") }}"
+      - "PVE_PASSWORD={{ secret__prometheus_pve_exporter_pve_password }}"
       - PVE_VERIFY_SSL=false
     volumes:
       - /dev/null:/etc/prometheus/pve.yml

resources/chaosknoten/grafana/docker_compose/grafana.ini.j2

@@ -11,7 +11,7 @@ auto_login = true
 name = id.hamburg.ccc.de
 allow_sign_up = true
 client_id = grafana
-client_secret = {{ lookup("community.sops.sops", "resources/chaosknoten/grafana/secrets.yaml", extract="['KEYCLOAK_SECRET']") }}
+client_secret = {{ secret__grafana_keycloak_secret }}
 scopes = openid email profile offline_access roles
 email_attribute_path = email
 login_attribute_path = username