fix(agent): resolve secrets_manager alongside identity_administration

[roeezis]

Summary

Part 3 of the SMS/Conjur JWT authentication series (split out of #817). Stacked on #818, #819 — diff will shrink once those merge.

The Service Discovery API returns several independently-hosted services; the authn-jwt exchange this series adds is served by secrets_manager, a different host from identity_administration. Adds a SecretsManager field to Services and parses it, so callers have it available — nothing reads it yet, that lands in a later PR alongside the client that needs it.

Test plan

• go build ./...
• go test ./internal/cyberark/servicediscovery/... ./internal/envelope/...

[mladen-rusev-cyberark]

Correct and minimal. The assert.NotEqual(t, services.Identity.API, services.SecretsManager.API) assertion is the right one — it defends against the exact failure mode where a downstream mock points at whichever field the code reads, so tests pass and production 404s.

Approving in spirit; the one comment below is a docs request, not a change request.

[roeezis]

All three addressed:

• Added a comment above the identityAPI check making explicit that secretsManagerAPI/discoveryContextAPI are intentionally not required there, with a note that not every caller validates discoveryContextAPI yet (keyfetch doesn't).
• Answered the discoveryContextAPI TODO in that same comment rather than leaving it as an open question.
• Factored the three identical endpoint-selection loops into a mainActiveAPI helper.

[roeezis]

Added the note above identityAPI == "" per your first optional follow-on, and updated pkg/testutil/envtest.go:291's comment to cite it instead of reading like a workaround.