Route more than one credential provider through ate-setup #2829

The egress gateway already picks a credential provider by the ate-secret:// authority and accepts a list of them, but --credential-provider takes a single object. So a provider you deploy yourself replaces the bundled k8s.io one instead of running beside it, and policies that name the other class fail closed.

Proposal: let --credential-provider also take a JSON array of the same objects, one per class, each rendered as its own entry on the agentgateway egress. Repeated names would be refused. The Envoy dataplane only takes one provider, so it would refuse more than one. The "For credential provider developers" docs would describe routing a provider deployed beside Substrate.

For example, we run a provider that mints Vertex AI access tokens from a service account key (https://github.com/giantswarm/substrate-credential-providers), and we need it next to k8s.io. kagent-dev#90 does the same for the Helm chart. I have the change ready and can open a PR.