Put the artifactapi web UI behind Authentik oauth2-proxy

Front /ui with an Authentik-authenticated oauth2-proxy while leaving every
package-manager surface unauthenticated.

- Add the oauth2-proxy ConfigMap, Deployment, Service and VMPodScrape.
- Add the oauth-credentials VaultStaticSecret.
- Split httproute: /ui and /oauth2 to oauth2-proxy (HTTPS, plus an HTTP
  redirect); everything else to the api Service on both listeners.

apps/base/artifactapi/kustomization.yaml

@@ -12,6 +12,8 @@ resources:
   - gateway.yaml
   - httproute.yaml
   - namespace.yaml
+  - oauth2-proxy-configmap.yaml
+  - oauth2-proxy-deployment.yaml
   - redis-deployment.yaml
   - services.yaml
   - ui-deployment.yaml