Omit empty AWS secret replica regions

Fixed External Secrets Operator's AWS Secrets Manager create path so PushSecrets without replicationLocations no longer send an empty AddReplicaRegions request field.

external-secrets/external-secrets · #6596

Problem

When a PushSecret created a new AWS Secrets Manager secret with metadata but no replicationLocations, ESO sent AddReplicaRegions as an empty slice. AWS rejected that create request even though the user had not configured replica regions.

Approach

Updated the AWS Secrets Manager provider to set CreateSecretInput.AddReplicaRegions only when configured replication locations produce at least one replica region, while preserving existing replication behavior when locations are configured.

Impact and scope

Restores normal PushSecret creation for AWS Secrets Manager users who do not configure multi-region replication.
Aligns create-path behavior with the update path, which already skips replication management when replicationLocations is absent.
Avoids forcing users to pre-create secrets manually as a workaround for an empty optional provider field.

Validation

Added regression coverage for creating a new secret with PushSecret metadata and no replicationLocations.
Test verifies AddReplicaRegions is omitted from the AWS CreateSecret request instead of sent as an empty slice.
Merged after maintainer review, with focused provider tests, make test, and make reviewable documented in the PR.