Add ExternalSecret default fields to prevent ArgoCD drift

The external-secrets operator adds conversionStrategy, decodingStrategy,
and metadataPolicy defaults to the live object, causing perpetual
OutOfSync in ArgoCD. Declare them explicitly to match.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

argocd/manifests/argocd/external-secret-oidc-authentik.yaml

@@ -24,5 +24,8 @@ spec:
   data:
     - secretKey: client-secret
       remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
         key: "Authentik (blumeops)"
+        metadataPolicy: None
         property: argocd-client-secret