TL;DR
As you wrote, the dataFrom field requires JSON format. To get the raw secret value you can remoteRef.
dataFrom
remoteRef
Check my answer to the similar post - https://stackoverflow.com/a/79421344/29483174