staging: add support for storage masking

This MR (finally!) introduces storage masking support for staging.

• Add support for the masking admin cli in the toolbox
• Add support for pre-processing pipeline steps definitions (needed to be able to generate the masking_db parameter out of a secret/envvar for the masking proxy)
• Use the masking proxy in both read-only storage backends

The postgresql read-only RPC backend had the retry pipeline step enabled; I think that was a mistake? So I split the readonly pipeline steps into two variables:

• readOnlyStoragePipelineSteps for the rpc clients
• readOnlyStorageBackendPipelineSteps for the rpc servers

https://krkr.eu/tmp/2024-04-04-ayuHlx8fXLo/helm-diff.html