cmd/adkgo: support Agent Engine secret env vars

[Haihan-Jiang]

Fixes #849.

Summary:

• Add repeatable --secret ENV=SECRET:VERSION support to adkgo deploy agentengine.
• Use the configured secrets for Agent Engine SecretEnv instead of always requiring a GOOGLE_API_KEY secret.
• Apply configured secrets when updating an existing Agent Engine as well as when creating one.
• Add unit coverage for secret parsing and deployment spec construction.

Users who still want to provide the Gemini API key can pass:

adkgo deploy agentengine --secret GOOGLE_API_KEY=GOOGLE_API_KEY:latest ...

Tests:

• go test ./cmd/adkgo/internal/deploy/agentengine
• go test ./cmd/adkgo/internal/deploy/agentengine -run 'TestParseSecretEnvVars|TestDeploymentSpec' -count=10\n- go test ./cmd/adkgo/...\n- go run ./cmd/adkgo deploy agentengine --help | rg -- '--secret|Agent Engine|Deploys'\n- git diff --check