cephrgw-system: source cephrgw-credentials from Vault via VSO

Replace the out-of-band cephrgw-credentials Secret with a VSO-managed one so
the operator's Ceph dashboard credentials come from Vault.

- Add apps/base/cephrgw-system/vaultauth.yaml: VaultAuth (k8s/au/syd1 mount,
  role cephrgw-operator, SA cephrgw-operator, connection vso-system/default).
- Add apps/base/cephrgw-system/vaultstaticsecret.yaml: renders the KV path
  service/cephrgw/dashboard-credentials into the cephrgw-credentials Secret
  (keys copied verbatim, consumed by the Deployment via envFrom).
- Reference both from the base kustomization.

Requires the Vault role/policy from terraform-vault #95 and the KV values to
be seeded (see the operator's docs/ceph-setup.md).

apps/base/cephrgw-system/vaultauth.yaml

@@ -0,0 +1,18 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  name: default
+  namespace: cephrgw-system
+spec:
+  method: kubernetes
+  mount: k8s/au/syd1
+  vaultConnectionRef: vso-system/default
+  allowedNamespaces:
+    - cephrgw-system
+  kubernetes:
+    role: cephrgw-operator
+    serviceAccount: cephrgw-operator
+    audiences:
+      - vault
+    tokenExpirationSeconds: 600