Package encapic as an RPM published to rpm-internal

The VM puppet masters are dnf-managed hosts moving off cobbler onto encapi,
and encapic ships only as a release binary the k8s compilers curl.

- drive the release with goreleaser, keeping the encapic_linux_amd64 asset
  and its .sha256 byte-compatible with the compiler initContainer
- build encapic-<version>-1.x86_64.rpm and PUT it to artifactapi rpm-internal
- install /usr/bin/encapic, the /usr/bin/encapic-enc ENC entrypoint and
  /etc/encapic/encapic.conf as %config(noreplace)
- add make rpm/rpm-package/pre-commit and a PR packaging check

packaging/encapic-enc

@@ -0,0 +1,13 @@
+#!/bin/sh
+# Puppet's exec node_terminus invokes external_nodes with a certname and no
+# environment, so the encapi URL cannot be inherited; source it here instead.
+set -eu
+
+if [ -r /etc/encapic/encapic.conf ]; then
+	. /etc/encapic/encapic.conf
+fi
+if [ -n "${ENCAPI_URL:-}" ]; then
+	export ENCAPI_URL
+fi
+
+exec /usr/bin/encapic "$@"

packaging/encapic.conf

@@ -0,0 +1,4 @@
+# Base URL of the encapi service, read by /usr/bin/encapic-enc.
+# The binary's compiled-in default is the in-cluster address, which VM puppet
+# masters cannot resolve.
+ENCAPI_URL=https://encapi.k8s.syd1.au.unkin.net