Is your feature request related to a problem? Please describe.
In a multi-tenant environment using External Secrets Operator (ESO), we face a limitation with the current deployment modes. ESO currently supports two modes:

Cluster-wide: which manages all namespaces in the cluster
Namespace-scoped: limited to a single specific namespace

This creates a challenge in multi-tenant environments where a tenant owns multiple namespaces. We are forced to either deploy one ESO per namespace (creating operational overhead) or use cluster-wide mode (which create security and isolation issues between tenants).

Describe the solution you'd like
I propose adding a third deployment mode: tenant-scoped mode that would allow:

1. Deploying a single ESO instance in a dedicated namespace for each tenant
2. Configuring this ESO to manage all namespaces belonging to that tenant, identified via specific labels
3. Maintaining isolation between tenants while simplifying management

Specifically, this would involve:

• Adding a tenant-scoped configuration option in the Helm chart and deployment options
• Implementing namespace filtering logic based on labels to identify those belonging to the tenant
• Setting up appropriate RBAC permissions to allow the ESO instance to operate only on the tenant's namespaces

Describe alternatives you've considered
Deploying one ESO per namespace: a functional solution but generates significant resource consumption and operational complexity (many instances to maintain).

Additional context
Concrete usage example:

• Tenant namespace: app-tenant-a (with label: tenant=a)
• Tenant's ESO namespace: eso-tenant-a
• ESO deployed in eso-tenant-a automatically manages all namespaces with the label tenant=a

This feature aligns with the trend of multi-tenant architectures on Kubernetes and would significantly improve the operational experience for teams managing such environments.