fix(ci): correct default RBAC GitHub App env vars

[gustavolira]

Description

In .ci/pipelines/env_variables.sh, the default RBAC GitHub App block (used whenever the per-run prefix rotation finds an incomplete _RBAC_<n> secret set — see override_github_app_env_with_prefix) has two bugs:

• GITHUB_APP_PRIVATE_KEY_RBAC reads GITHUB_APP_CLIENT_SECRET_OPERATOR — an app JWT can never be minted from a client secret, so every GitHub App call from the RBAC namespace fails with 401 Unauthorized (breaking catalog discovery and bulk-import) whenever the defaults kick in.
• GITHUB_APP_CLIENT_SECRET_RBAC is missing from the block entirely.

Same fix as the release-1.9 counterpart in #5441 (where the 2026-09-18 gke-operator nightly showed the resulting Fetching repositories with token from token failed 401 Unauthorized).

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 64.04%. Comparing base (24f9e3f) to head (7f5eea0).
⚠️ Report is 4 commits behind head on main.

Additional details and impacted files

@@             Coverage Diff             @@
##             main    #5442       +/-   ##
===========================================
- Coverage   74.21%   64.04%   -10.17%     
===========================================
  Files          69       57       -12     
  Lines         799      573      -226     
  Branches      125       99       -26     
===========================================
- Hits          593      367      -226     
  Misses        205      205               
  Partials        1        1               

Flag	Coverage Δ
rhdh	64.04% <ø> (-10.17%)	⬇️

Components	Coverage Δ
Backend plugins	∅ <ø> (∅)
Backend app	71.91% <ø> (ø)
Frontend app	60.50% <ø> (ø)
Plugin utils	∅ <ø> (∅)

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 24f9e3f...7f5eea0. Read the comment docs.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

Image was built and published successfully. It is available at:

• quay.io/rhdh-community/rhdh:pr-5442
• quay.io/rhdh-community/rhdh:pr-5442-7f5eea05

[hopehadfield]

/lgtm