Support pass credentials to functions

[daftping]

What problem are you facing?

When Composition uses https://github.com/upbound/function-msgraph with Workload Identity Credentials, crossplane-diff xr command fails to retrieve credentials. I assume this is expected behavior, since explicit secrets are intentionally not present.

Composition

    - step: get-groups
      functionRef:
        name: function-msgraph
      input:
        apiVersion: msgraph.fn.crossplane.io/v1alpha1
        kind: Input
        queryType: GroupObjectIDs
        groupsRef: "context.all.groupNames"
        target: "status.groupIDs"
        identity:
          type: AzureWorkloadIdentityCredentials

Logs

2026-01-02T12:34:08-08:00       DEBUG   Creating Docker container       {"image": "<reducted>/crossplane-contrib/function-auto-ready:v0.5.0", "address": "127.0.0.1:46361", "name": ""}
2026-01-02T12:34:09-08:00       DEBUG   Render completed with error     {"renderNumber": 1, "error": "cannot get credentials from secret \"function-msgraph\": secret \"function-msgraph\" not found", "duration": "3.912832452s"}
2026-01-02T12:34:09-08:00       DEBUG   Resource rendering failed completely    {"resource": "<reducted>", "iteration": 1, "error": "cannot get credentials from secret \"function-msgraph\": secret \"function-msgraph\" not found"}
2026-01-02T12:34:09-08:00       DEBUG   Resource rendering failed       {"resource": "<reducted>", "error": "cannot render resources: cannot get credentials from secret \"function-msgraph\": secret \"function-msgraph\" not found"}
2026-01-02T12:34:09-08:00       DEBUG   Failed to process resource      {"resource": "<reducted>", "error": "cannot render resources with requirements: cannot render resources: cannot get credentials from secret \"function-msgraph\": secret \"function-msgraph\" not found"}
ERROR: Failed to process <reducted>: cannot render resources with requirements: cannot render resources: cannot get credentials from secret "function-msgraph": secret "function-msgraph" not found

How could Crossplane help solve your problem?

Allow overwriting credentials, similarly to how it is implemented in the crossplane render command.
Implementation PR crossplane/crossplane#5976

crossplane render ... --function-credentials="credentials.yaml"