Add imagePullSecrets and extend imagePullPolicy to all chart images

Extend imagePullPolicy override support and add imagePullSecrets configuration for all container images in the Helm chart.

Background

PR #352 introduced the ability to override imagePullPolicy for conductor and stage images. However, this configuration is not available for other images used in the chart:

• descriptors image
• debezium-server image

Additionally, there's currently no support for configuring imagePullSecrets, which is needed for pulling images from private registries.

Proposed Enhancement

1. Extend imagePullPolicy Override

Add imagePullPolicy configuration support for:

• descriptors image
• debezium-server image

This should follow the same pattern established in #352 for conductor and stage images.

2. Add imagePullSecrets Support

Introduce imagePullSecrets configuration with a hybrid approach:

• Global configuration: A chart-level imagePullSecrets that applies to all container images by default
• Per-image override: Optional per-component imagePullSecrets that override the global setting when specified

This should apply to all container images in the chart:

• conductor image
• stage image
• descriptors image
• debezium-server image

Use Case

This enhancement is particularly important for:

• Private registries: Organizations using private container registries need to provide pull secrets (most common: single global secret)
• Multiple registry sources: Advanced deployments pulling images from different private registries need per-image secret configuration
• Custom pull policies: Different environments (dev/staging/prod) may require different image pull policies for all components
• Air-gapped deployments: Environments that mirror images to private registries need both pull secrets and consistent pull policy configuration

Acceptance Criteria

• imagePullPolicy can be configured for descriptors image
• imagePullPolicy can be configured for debezium-server image
• Global imagePullSecrets can be specified at chart level
• Global imagePullSecrets are applied to all container specs by default
• Per-component imagePullSecrets can override global configuration
• Chart documentation is updated with the new configuration options
• Maintains backward compatibility (new fields are optional)

Example Configuration

# values.yaml

# Global configuration (most common use case)
imagePullSecrets:
  - name: my-registry-secret
  - name: backup-registry-secret

# Global pull policy
imagePullPolicy: IfNotPresent

# Per-component overrides (advanced use cases)
conductor:
    imagePullPolicy: Always
    imagePullSecrets:  # overrides global
      - name: conductor-specific-secret

descriptors:
    imagePullPolicy: IfNotPresent
    imagePullSecrets:  # overrides global
      - name: descriptors-registry-secret

debeziumServer:
    imagePullPolicy: Never
    # inherits global imagePullSecrets if not specified

Implementation Notes

The per-component imagePullSecrets should completely override the global setting (not merge), following standard Kubernetes behavior and common Helm chart patterns.