Move the Vaultwarden bridge and the ClusterSecretStores out of external-secrets into secret-stores (wave 4, after vaultwarden). A store key may be an item UUID or an item name used as a path (k8s/<namespace>/<what>), matched exactly.