fix: honor PULL_SECRET env var in firmware refval collection

[butler54]

Problem

Running rhdp/wrapper.sh for an Azure deployment resulted in a veritas
authentication failure during the "retrieving PCR measurements" step,
even though cluster provisioning (which also needs a pull secret)
succeeded.

scripts/collect-firmware-refvals.sh hardcodes its pull secret default
to ~/pull-secret.json and only accepts an override via the
-p/--pull-secret CLI flag — it does not honor a PULL_SECRET
environment variable. rhdp/wrapper.sh and the Makefile's
collect-firmware-refvals / collect-azure-refvals targets both invoke
the script without forwarding a pull secret override.

Meanwhile, rhdp/rhdp-cluster-define.py (used to provision the cluster
itself) does support --pull-secret / the PULL_SECRET env var, and
rhdp/README.md already documents PULL_SECRET as applying
automatically "to all three wrapper scripts without any extra flags" —
which was not actually true for reference-value collection.

Net effect: whenever the pull secret used to define the cluster (via
PULL_SECRET) lives somewhere other than ~/pull-secret.json, veritas
silently authenticates with the wrong/stale credentials and fails.

Fix

• scripts/collect-firmware-refvals.sh: default PULL_SECRET from the
  environment (${PULL_SECRET:-${HOME}/pull-secret.json}), matching the
  precedence already used by rhdp-cluster-define.py's
  resolve_pull_secret(). -p/--pull-secret still takes precedence when
  passed explicitly.
• rhdp/wrapper.sh: explicitly forward --pull-secret to the refval
  collection step, alongside the script's other explicit credential
  checks (GUID, CLIENT_ID, etc.).
• Updated README.md, docs/firmware-reference-values.md, and the
  script's own --help/error text to document the PULL_SECRET
  override.

Testing

This also fixes the plain Makefile path, which previously had no way to
pass a pull secret override at all:

export PULL_SECRET=/path/to/pull-secret.json
make collect-azure-refvals
# or
make collect-azure-refvals PULL_SECRET=/path/to/pull-secret.json

Verified locally:

• bash -n syntax check on both modified scripts
• --help output renders correctly after the header-comment line shift
• ${PULL_SECRET:-${HOME}/pull-secret.json} precedence behaves as
  expected with and without the env var set, and -p/--pull-secret
  still overrides both

Verification pending on the APAC lab jump host / RHDP Azure environment
where the original failure was observed (full rhdp/wrapper.sh run and
make collect-azure-refvals with PULL_SECRET set to a non-default
path).