ghp: use the estate templated default Vault convention

Drop the bespoke ghp SA/role/policy (terraform-vault#120 closed). The default
k8s auth role, bound to SA default in every namespace, already has a templated
read grant on kv/kubernetes/namespace/<ns>/default/*, so ghp needs zero
terraform-vault change.

- Remove the custom ServiceAccount; run as the namespace default SA.
- Deployment + migrate Job: serviceAccountName default.
- VaultAuth: role/serviceAccount default (mirrors artifactapi).
- VaultStaticSecrets: source paths move to the templated location
  kubernetes/namespace/ghp/default/{github-app,app}; Secret names unchanged.

apps/base/ghp/kustomization.yaml

@@ -4,7 +4,6 @@ kind: Kustomization
 
 resources:
   - namespace.yaml
-  - serviceaccount.yaml
   - configmap.yaml
   - cnpg_cluster.yaml
   - cnpg_backup.yaml