Require tokens for artifactapi uploads (#574)

Woodpecker uploaders now mint Vault OIDC tokens, so anonymous local-repo writes can be rejected.

- set `ARTIFACTAPI_AUTH_UPLOADS: "true"` in the artifactapi `api-env` configmap

Merge after unkin/vault-plugin-secrets-litellm#6.

Reviewed-on: #574
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

apps/base/artifactapi/configmap.yaml

@@ -5,6 +5,7 @@ metadata:
   name: api-env
   namespace: artifactapi
 data:
+  ARTIFACTAPI_AUTH_UPLOADS: "true"
   ARTIFACTAPI_OIDC_AUDIENCE: artifactapi
   ARTIFACTAPI_OIDC_ISSUER: https://vault.service.consul:8200/v1/identity/oidc
   DBHOST: postgres-pooler