Secrets in onboardingConfig should not be resolved

[rarkins]

Describe the proposed change(s).

Ref: #30837

The challenge here is that it's possible that some handlebars templates in onboardingConfig should be resolved, while some not.

I think a quick way to resolve this in a major release would be to add new config option onboardingConfigCompilation which defaults to false. If true, the current behavior will occur, and users should not opt into it if they include secrets in templates. Otherwise onboardingConfig compilation should be skipped.