[cbarbian-sap]

So far, with spec.substituteFrom, the whole content of the referenced secrets is merged and passed to envsubst (such that secret keys become variables). With this PR keys can be filtered and mapped, such as:

spec:
  substituteFrom:
  - name: my-secret
    items:
    - key: original-name
      as: ALIASED_NAME
```

If items is not specified or empty, the original behaviour happens (that is all secret keys are used unchanged).
Also note that transforming happens before merging; that is, the transformed keys are used for the merge.