Fix Authelia OIDC config to use expand-env filter with ${VAR} substitution

- Switch X_AUTHELIA_CONFIG_FILTERS from template to expand-env so ${VAR}
  syntax in config files is actually substituted
- Add missing env var pass-throughs for OIDC HMAC secret and client secrets
- Update git config client_secret fields to use ${VAR} syntax (matching host)
- Update .env.example to document all required Portainer env vars

authelia/config/configuration.yaml

@@ -65,7 +65,7 @@ identity_providers:
     clients:
       - client_id: open-webui
         client_name: Open WebUI
-        client_secret: '{{ secret "/config/secrets/oidc_open_webui" }}'
+        client_secret: '${AUTHELIA_OIDC_CLIENT_SECRET_OPEN_WEBUI}'
         public: false
         authorization_policy: one_factor
         token_endpoint_auth_method: client_secret_post
@@ -79,7 +79,7 @@ identity_providers:
 
       - client_id: linkding
         client_name: Linkding
-        client_secret: '{{ secret "/config/secrets/oidc_linkding" }}'
+        client_secret: '${AUTHELIA_OIDC_CLIENT_SECRET_LINKDING}'
         public: false
         authorization_policy: one_factor
         token_endpoint_auth_method: client_secret_post