Mutating webhook does not run if secrets are only set through a configMap

[isaac-ped]

The mutateContainer hook skips mutation if no environment variables are set with a secret reference:

// Ignore if there are no berglas references in the container.
if !m.hasBerglasReferences(c.Env) {
    return c, false
}

However, environment variables can also be defined from configmaps, such as:

 envFrom:
   - configMapRef:
       name: config-map-name

If there is a single env entry with the sm:// prefix, the container will be mutated and the configmap variables will be resolved with berglas exec at runtime. This behavior for configMapRef variables changes when the unrelated env variables are removed.

Ideally, hasBerglasReferences would be run on all env variables that the container will use, rather than just those explicitly defined in the env section of the deployment.