Add optional methods attribute to the arrstack role resource (#3)

## Why

Engine plugin v0.2.0 added a `methods` field to arrstack roles, pinning a minted arrproxy key to a set of HTTP methods so a read-only integration can be handed a key that cannot write. The provider had no way to express it, so those roles could not be managed from `terraform-vault`.

## How

- Adds an optional `methods` set attribute to `arrstack_secret_backend_role`, validated at plan time against `GET/HEAD/POST/PUT/PATCH/DELETE/OPTIONS` (upper case only, since the engine stores them upper-cased and a lower-case value would drift on every plan).
- Always writes `methods`: the engine only clears an existing scope when the key is present, so an omitted key would leave a stale scope behind.
- Reads an unrestricted role back as null rather than an empty set, so a config that omits `methods` shows no drift; a scope cleared out of band still surfaces as a diff.
- Documents the attribute in the README and both example configs.
- Tests cover the write mapping (null and populated), the read-back cases (absent/empty/null/cleared), and the plan-time validator.

Dependency: engine plugin >= 0.2.0.
Reviewed-on: #3
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

README.md

@@ -14,7 +14,7 @@ Source address: `artifactapi.k8s.syd1.au.unkin.net/terraform-unkin/vault-secrets
 | Resource | Manages |
 |----------|---------|
 | `arrstack_secret_backend` | Mounts the engine at a path and writes its `config` (arrproxy base URL, request timeout, seeded admin token, optional CA cert). |
-| `arrstack_secret_backend_role` | A role: `apps` (subset of sonarr/radarr/prowlarr), `ttl`, `max_ttl`. |
+| `arrstack_secret_backend_role` | A role: `apps` (subset of sonarr/radarr/prowlarr), optional `methods` (HTTP method scope), `ttl`, `max_ttl`. |
 
 ## Usage
 
@@ -45,6 +45,16 @@ resource "arrstack_secret_backend_role" "all" {
   ttl     = 60
   max_ttl = 86400
 }
+
+# Read-only role: keys minted from it may only issue GET/HEAD.
+resource "arrstack_secret_backend_role" "sonarr_ro" {
+  backend = arrstack_secret_backend.arrstack.path
+  name    = "sonarr-ro"
+  apps    = ["sonarr"]
+  methods = ["GET", "HEAD"]
+  ttl     = 60
+  max_ttl = 86400
+}
 ```
 
 ### Notes
@@ -55,6 +65,12 @@ resource "arrstack_secret_backend_role" "all" {
 - Writing `config` makes the engine authenticate against arrproxy as an admin,
   so a bad URL or token fails the apply.
 - `apps` is required; entries must be a subset of `sonarr`, `radarr`, `prowlarr`.
+- `methods` is optional and restricts a minted key to those HTTP methods;
+  omitting it (or setting `[]`) leaves the key unrestricted. Entries must be
+  upper case and a subset of `GET`, `HEAD`, `POST`, `PUT`, `PATCH`, `DELETE`,
+  `OPTIONS` — the engine stores them upper-cased, so a lower-case value would
+  show permanent drift and is rejected at plan time. Requires engine plugin
+  `vault-plugin-secrets-arrstack` >= 0.2.0.
 
 ## Import