Implement core.IntegrationSecretProvider for GitLab and OpenAI integrations

[superplanehq-integration]

Implement core.IntegrationSecretProvider for GitLab and OpenAI integrations.

Problem

The core.IntegrationSecretProvider interface (pkg/core/integration_secret_provider.go) lets integrations materialize key/value secrets that other parts of the system (runners, components, etc.) can consume via ResolveSecrets(ctx core.IntegrationSecretContext) (map[string][]byte, error). It is already implemented by GitHub, Semaphore, and Claude, but not by GitLab or OpenAI.

• The consumer in pkg/workers/contexts/secrets_context.go type-asserts the integration to core.IntegrationSecretProvider and returns integration %q does not provide secrets when it is missing, so GitLab and OpenAI cannot export their credentials today.
• GitLab supports two auth types (see getAuthToken in pkg/integrations/gitlab/common.go): personal access token (accessToken config) and app OAuth (OAuthAccessToken secret); both need to be handled.
• OpenAI reads apiKey (required), adminKey (optional), and baseURL (optional) from config (see pkg/integrations/openai/client.go).

Approach

• Follow the existing pattern in pkg/integrations/semaphore/integration_secrets.go and pkg/integrations/claude/integration_secrets.go: add an integration_secrets.go file per integration with a ResolveSecrets method on the integration type.
• Reuse existing token/key resolution helpers (getAuthToken for GitLab) rather than duplicating logic.
• Use stable, descriptive env-style secret keys (e.g. GITLAB_TOKEN, OPENAI_API_KEY) consistent with existing conventions.

Acceptance Criteria

• *gitlab.GitLab implements core.IntegrationSecretProvider and returns its access token for both personal-access-token and app-OAuth auth types.
• *openai.OpenAI implements core.IntegrationSecretProvider and returns the API key, plus the admin key and base URL when they are configured.
• Both implementations return a clear error when a required credential is missing or empty.
• Secret keys are defined as named constants and are non-empty, trimmed values.
• Unit tests are added for both ResolveSecrets methods following the pattern in pkg/integrations/semaphore/integration_secrets_test.go, covering success and missing-credential cases.
• pkg/workers/contexts/secrets_context.go successfully resolves secrets for GitLab and OpenAI integrations (no longer returns the "does not provide secrets" error).

---

Automatically created by the Software Factory app on SuperPlane

[superplanehq-integration]

Taking a look!
Follow my progress: #6349