woodpecker: add ghp CI ServiceAccount (#364)

## Why

The ghp fork (`unkin/ghp`) now has `.woodpecker` pipelines whose steps run under `serviceAccountName: ghp`. Without this ServiceAccount in the `woodpecker` namespace, pods fail to schedule (`error looking up service account woodpecker/ghp: serviceaccount "ghp" not found`), which fails the required `ci/woodpecker/pr/build` status.

## Change

- Add `apps/base/woodpecker/serviceaccount_ghp.yaml` (ServiceAccount `ghp` in namespace `woodpecker`), mirroring the existing per-project SAs (e.g. `jellyfin-ha-src`).
- Register it in `apps/base/woodpecker/kustomization.yaml`.

Unblocks the ghp CI onboarding for unkin/ghp#1.

Reviewed-on: #364
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

apps/base/woodpecker/kustomization.yaml

@@ -8,6 +8,7 @@ resources:
   - cnpg_backup.yaml
   - cnpg_pooler.yaml
   - serviceaccount_autobackup_operator_ci.yaml
+  - serviceaccount_ghp.yaml
   - serviceaccount_kea_operator_ci.yaml
   - serviceaccount_jellyfin_ha_src.yaml
   - serviceaccount_terraform_artifactapi.yaml

apps/base/woodpecker/serviceaccount_ghp.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: ghp
+  namespace: woodpecker