Add optional methods attribute to the arrstack role resource

Engine plugin v0.2.0 added a `methods` field to roles, pinning a minted
arrproxy key to a set of HTTP methods so a read-only integration can be
handed a key that cannot write. The provider had no way to express it.

- Add an optional `methods` set attribute to arrstack_secret_backend_role,
  validated at plan time against GET/HEAD/POST/PUT/PATCH/DELETE/OPTIONS.
- Always write `methods`, since the engine only clears a scope when the key
  is present; an unrestricted role reads back as null rather than an empty
  set so an omitted config value does not drift.
- Document the attribute in the README and examples, and cover the write
  mapping, read-back, and validation in tests.

examples/main.tf

@@ -39,3 +39,13 @@ resource "arrstack_secret_backend_role" "prowlarr" {
   ttl     = 60
   max_ttl = 86400
 }
+
+# Role scoped to read-only traffic across all three apps.
+resource "arrstack_secret_backend_role" "readonly" {
+  backend = arrstack_secret_backend.arrstack.path
+  name    = "readonly"
+  apps    = ["sonarr", "radarr", "prowlarr"]
+  methods = ["GET", "HEAD"]
+  ttl     = 60
+  max_ttl = 86400
+}

examples/resources/arrstack_secret_backend_role/main.tf

@@ -9,3 +9,15 @@ resource "arrstack_secret_backend_role" "sonarr" {
   ttl     = 60    # 1m
   max_ttl = 86400 # 24h
 }
+
+# The same role narrowed to read-only traffic: keys minted from it may only
+# issue GET/HEAD against Sonarr. Omitting methods leaves a key unrestricted.
+resource "arrstack_secret_backend_role" "sonarr_ro" {
+  backend = arrstack_secret_backend.arrstack.path
+  name    = "sonarr-ro"
+  apps    = ["sonarr"]
+  methods = ["GET", "HEAD"]
+
+  ttl     = 60    # 1m
+  max_ttl = 86400 # 24h
+}