SCHED-1456: Fix vmagent remotewrite in umbrella chart

[Uburro]

Problem

vmagent received the Nebius o11y bearer token via a global -remoteWrite.bearerTokenFile arg, which vmagent applies to every remote-write URL. This leaked the token to other endpoints and blocked adding extra customer remote-write destinations with their own auth.

Solution

Use per-URL bearerTokenSecret for the o11y endpoint (secret kind) and an o11y-scoped positional bearerTokenFile (hostPath kind), so extra destinations can carry their own auth. Replaced the in-pod IMDS sidecar with a standalone tsa-token-writer (bedag raw HelmRelease) that maintains the o11y-writer-sa-token Secret from IMDS or a host file.

Testing

• helm unittest 117/117, helm lint clean, full helm template for both token kinds and writer sources.
• in live cluster

Release Notes

Feature: vmagent authenticates o11y remote-write via per-URL bearerTokenSecret, allowing extra remote-write destinations with independent auth; token Secret maintained by the new tsa-token-writer. Breaking: removed the vmagent IMDS sidecar and tsaTokenSidecar values — use publicEndpointTokenKind (secret/hostPath).