Upgrade openbao-plugin-secrets-rancher to latest (v0.1.1) (#488)

## Why

The vault nodes have rancher plugin v0.1.0, which mints non-functional tokens (returns `status.value` not `status.bearerToken`; every cred/rotation 401s). v0.1.1 fixes it. `ensure_packages` defaults to `present`, which won't upgrade an already-installed package, so pin to `latest` to pull v0.1.1.

## Changes

- `openbao-plugin-secrets-rancher: { ensure: latest }` on the vault storage role.

## Note

`latest` will also pull future releases automatically — keep the terraform-vault catalog sha256 (`config/plugins/vault-plugin-secrets-rancher.yaml`) bumped in lockstep, or a vault restart after a future upgrade will fail the sha check. Happy to pin to an exact version instead if you'd prefer lockstep-by-pin.

---------

Co-authored-by: Ben Vincent <neotheo@gmail.com>
Reviewed-on: #488
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>

hieradata/roles/infra/storage/vault.yaml

@@ -30,4 +30,5 @@ profiles::packages::include:
   openbao-plugins: {}
   openbao-plugin-secrets-litellm: {}
   openbao-plugin-secrets-gpg: {}
-  openbao-plugin-secrets-rancher: {}
+  openbao-plugin-secrets-rancher:
+    ensure: latest