Support updates to existing agent image pull secrets

[weyfonk]

When image pull secrets are configured through e.g. global.cattle.imagePullSecrets, those secrets should be monitored so that, when they are updated, their updated versions are propagated to agent deployments.

Acceptance criteria:

• updates to secrets referenced by global.cattle.imagePullSecrets should lead to propagation of those updates to downstream clusters, for agent deployments to be able to use them
• agent should be re-deployed upon reception of those secrets updates, to ensure that they use the latest secrets
• as per Enable agent image pull secrets propagation to be disabled #5254, for downstream clusters which Fleet Cluster resource has a non-nil agentPullSecrets, updates to secrets referenced by Fleet-wide global.cattle.imageSecrets should not be propagated.