feat: support protected repositories with Tekton Chains provenance

[minmzzhang]

Add support for cloning source code from protected (private) Git repositories in the Tekton supply-chain pipeline. Credentials are stored in Vault and delivered to the pipeline via an ExternalSecret that generates .git-credentials and .gitconfig files for the git-clone task's basic-auth workspace.

Supply-chain chart changes:

• Add init task (skopeo pre-flight image check, skip rebuild)
• Add optional git-auth workspace and Chains provenance results (CHAINS-GIT_URL, CHAINS-GIT_COMMIT, IMAGE_URL, IMAGE_DIGEST)
• Add ExternalSecret for git credentials (Opaque with .git-credentials)
• Conditionally attach git-credentials secret to pipeline SA
• Add skopeo image to tasks.images for the init task
• Migrate all Tekton resources from v1beta1 to v1 API

Generator and feature fragments:

• Add protected-repos feature fragment with git.credentials overrides and qtodo.repository placeholder
• Add --git-repo CLI argument to gen-feature-variants.py (required when protected-repos feature is enabled)
• Add ignoreDifferences for Tekton Task/Pipeline defaulted fields to the supply-chain feature fragment

Default values-hub.yaml:

• Extend hub-supply-chain-jwt-secret Vault policy to cover secret/data/hub/supply-chain/*
• Add commented-out Tekton ignoreDifferences, git.credentials overrides, and qtodo.repository override

Documentation:

• Update docs/supply-chain.md with protected repos setup, generator --git-repo usage, and git-auth workspace selection
• Update scripts/gen-feature-variants.md with --git-repo examples
• Add git-credentials entry to values-secret.yaml.template