Scaffold terraform-provider-vault-secrets-arrstack

Configure the arrstack Vault secrets engine (backend config + roles) from
terraform-vault, matching the schema declared in terraform-vault #127.

- Add terraform-plugin-framework provider (local name arrstack) authenticating
  to Vault/OpenBao via address + token (VAULT_ADDR/VAULT_TOKEN fallback).
- Add arrstack_secret_backend resource: mounts the engine and writes <mount>/config.
- Add arrstack_secret_backend_role resource: manages <mount>/roles/<name>.
- Add Vault client, conversions, unit tests, Makefile, woodpecker CI + tag
  release to artifactapi terraform-unkin, examples, and README.

examples/resources/arrstack_secret_backend_role/main.tf

@@ -0,0 +1,11 @@
+# A role that mints short-lived arrproxy API keys scoped to a subset of the arr
+# apps. Reading arrstack/creds/<role> returns a lease-bound key that the engine
+# revokes when the lease ends.
+resource "arrstack_secret_backend_role" "sonarr" {
+  backend = arrstack_secret_backend.arrstack.path
+  name    = "sonarr"
+  apps    = ["sonarr"]
+
+  ttl     = 60    # 1m
+  max_ttl = 86400 # 24h
+}