Onboard OpenBao as an Authentik OIDC client

Adds config/providers_oauth2/vault.yaml so human logins to OpenBao go
through Authentik SSO (bao CLI and the web UI). Machine auth (approle,
kubernetes, CI) and break-glass are unchanged and stay on the OpenBao side.

Extends the oauth2 provider module so a config may generate its own client
secret instead of reading a pre-seeded one: client_secret_vault.generate
creates a random_password and writes {client_id, client_secret} to the given
kv-v2 path. Providers without the flag keep the existing read-only data source
behaviour. This is what lets the provider land with no manual Vault seed.

Gates the new application with akP-vault-admin and nests it in
akR-global-admin, matching how every other app in this repo is bound.

modules/authentik/versions.tf

@@ -9,5 +9,9 @@ terraform {
       source  = "hashicorp/vault"
       version = ">= 4.0.0"
     }
+    random = {
+      source  = "hashicorp/random"
+      version = ">= 3.6.0"
+    }
   }
 }