Dual-write ENC data into encapi alongside Cobbler

Seed encapi (statuses, roles, prodnxsr node assignments) and make the
instance module also create an encapi_node for every VM, so the k8s
puppetserver ENC can cut over from Cobbler. Cobbler/puppetca/puppetdb
resources are left untouched.

- Add config/encapi leaf + modules/encapi driving statuses/roles/nodes
  from YAML (3 statuses, 51 roles, 13 prodnxsr physical nodes).
- Add encapi_node to modules/instance (certname, role, environment).
- Wire encapi provider into root.hcl required_providers and the module
  providers; plumb ENCAPI_WRITE_TOKEN via Makefile vault_env.

config/root.hcl

@@ -26,7 +26,7 @@ inputs = {
 generate "backend" {
   path      = "backend.tf"
   if_exists = "overwrite_terragrunt"
-  contents = <<EOF
+  contents  = <<EOF
 terraform {
   required_providers {
     vault = {
@@ -49,6 +49,10 @@ terraform {
       source = "camptocamp/puppetdb"
       version = "2.0.0"
     }
+    encapi = {
+      source  = "git.unkin.net/unkin/encapi"
+      version = "0.1.0"
+    }
   }
   backend "consul" {
     address = "${local.consul_addr}"