feat: implement SOPS secret provider

[tonnico]

solves #6

[ameistad]

Nice! Looks good overall.

I found two issues:

1. In internal/configloader/resolve_secrets.go, the sops case uses := when loading sourceConfig and found. That shadows the outer variables, so the outer found remains false and SOPS sources are always treated as undefined.

2. In the same file, extractValues still parses secret refs using . instead of :. With the new syntax likesops:development:client.id, this can panic when resolving secrets.

[tonnico]

Many thanks for your review. I'm pretty new in golang.

I'm currently on holiday and will take a look next week on it.