Label the Vault-sourced TLS secret konghq.com/secret=true

The Kong Gateway Operator only watches Secrets carrying this label,
same as the existing Konnect PAT ExternalSecret already does.

dataplane-template/externalsecret-tls.yaml

@@ -12,6 +12,9 @@ spec:
     name: ${NAME}-tls
     template:
       type: kubernetes.io/tls
+      metadata:
+        labels:
+          konghq.com/secret: "true"
   data:
     - secretKey: tls.crt
       remoteRef: