Add optional methods attribute to the arrstack role resource (#3)

## Why

Engine plugin v0.2.0 added a `methods` field to arrstack roles, pinning a minted arrproxy key to a set of HTTP methods so a read-only integration can be handed a key that cannot write. The provider had no way to express it, so those roles could not be managed from `terraform-vault`.

## How

- Adds an optional `methods` set attribute to `arrstack_secret_backend_role`, validated at plan time against `GET/HEAD/POST/PUT/PATCH/DELETE/OPTIONS` (upper case only, since the engine stores them upper-cased and a lower-case value would drift on every plan).
- Always writes `methods`: the engine only clears an existing scope when the key is present, so an omitted key would leave a stale scope behind.
- Reads an unrestricted role back as null rather than an empty set, so a config that omits `methods` shows no drift; a scope cleared out of band still surfaces as a diff.
- Documents the attribute in the README and both example configs.
- Tests cover the write mapping (null and populated), the read-back cases (absent/empty/null/cleared), and the plan-time validator.

Dependency: engine plugin >= 0.2.0.
Reviewed-on: #3
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

examples/main.tf

@@ -39,3 +39,13 @@ resource "arrstack_secret_backend_role" "prowlarr" {
   ttl     = 60
   max_ttl = 86400
 }
+
+# Role scoped to read-only traffic across all three apps.
+resource "arrstack_secret_backend_role" "readonly" {
+  backend = arrstack_secret_backend.arrstack.path
+  name    = "readonly"
+  apps    = ["sonarr", "radarr", "prowlarr"]
+  methods = ["GET", "HEAD"]
+  ttl     = 60
+  max_ttl = 86400
+}

examples/resources/arrstack_secret_backend_role/main.tf

@@ -9,3 +9,15 @@ resource "arrstack_secret_backend_role" "sonarr" {
   ttl     = 60    # 1m
   max_ttl = 86400 # 24h
 }
+
+# The same role narrowed to read-only traffic: keys minted from it may only
+# issue GET/HEAD against Sonarr. Omitting methods leaves a key unrestricted.
+resource "arrstack_secret_backend_role" "sonarr_ro" {
+  backend = arrstack_secret_backend.arrstack.path
+  name    = "sonarr-ro"
+  apps    = ["sonarr"]
+  methods = ["GET", "HEAD"]
+
+  ttl     = 60    # 1m
+  max_ttl = 86400 # 24h
+}