Add optional methods attribute to the arrstack role resource (#3)

## Why

Engine plugin v0.2.0 added a `methods` field to arrstack roles, pinning a minted arrproxy key to a set of HTTP methods so a read-only integration can be handed a key that cannot write. The provider had no way to express it, so those roles could not be managed from `terraform-vault`.

## How

- Adds an optional `methods` set attribute to `arrstack_secret_backend_role`, validated at plan time against `GET/HEAD/POST/PUT/PATCH/DELETE/OPTIONS` (upper case only, since the engine stores them upper-cased and a lower-case value would drift on every plan).
- Always writes `methods`: the engine only clears an existing scope when the key is present, so an omitted key would leave a stale scope behind.
- Reads an unrestricted role back as null rather than an empty set, so a config that omits `methods` shows no drift; a scope cleared out of band still surfaces as a diff.
- Documents the attribute in the README and both example configs.
- Tests cover the write mapping (null and populated), the read-back cases (absent/empty/null/cleared), and the plan-time validator.

Dependency: engine plugin >= 0.2.0.
Reviewed-on: #3
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

internal/provider/resource_secret_backend_role.go

@@ -4,15 +4,22 @@ import (
 	"context"
 	"fmt"
 
+	"github.com/hashicorp/terraform-plugin-framework-validators/setvalidator"
+	"github.com/hashicorp/terraform-plugin-framework-validators/stringvalidator"
 	"github.com/hashicorp/terraform-plugin-framework/diag"
 	"github.com/hashicorp/terraform-plugin-framework/path"
 	"github.com/hashicorp/terraform-plugin-framework/resource"
 	"github.com/hashicorp/terraform-plugin-framework/resource/schema"
 	"github.com/hashicorp/terraform-plugin-framework/resource/schema/planmodifier"
 	"github.com/hashicorp/terraform-plugin-framework/resource/schema/stringplanmodifier"
+	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
 	"github.com/hashicorp/terraform-plugin-framework/types"
 )
 
+// validMethods mirrors the engine's knownMethods; the engine normalises to
+// upper case, so only the upper-case spelling round-trips without drift.
+var validMethods = []string{"GET", "HEAD", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"}
+
 var (
 	_ resource.Resource                = &secretBackendRoleResource{}
 	_ resource.ResourceWithImportState = &secretBackendRoleResource{}
@@ -26,6 +33,7 @@ type secretBackendRoleModel struct {
 	Backend types.String `tfsdk:"backend"`
 	Name    types.String `tfsdk:"name"`
 	Apps    types.Set    `tfsdk:"apps"`
+	Methods types.Set    `tfsdk:"methods"`
 	TTL     types.Int64  `tfsdk:"ttl"`
 	MaxTTL  types.Int64  `tfsdk:"max_ttl"`
 }
@@ -61,6 +69,14 @@ func (r *secretBackendRoleResource) Schema(_ context.Context, _ resource.SchemaR
 				ElementType: types.StringType,
 				Required:    true,
 			},
+			"methods": schema.SetAttribute{
+				Description: "HTTP methods a generated key is limited to (subset of GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS). Omit or leave empty for unrestricted.",
+				ElementType: types.StringType,
+				Optional:    true,
+				Validators: []validator.Set{
+					setvalidator.ValueStringsAre(stringvalidator.OneOf(validMethods...)),
+				},
+			},
 			"ttl": schema.Int64Attribute{
 				Description: "Default lease TTL in seconds for keys generated from this role.",
 				Optional:    true,
@@ -199,6 +215,14 @@ func roleData(ctx context.Context, m secretBackendRoleModel) (map[string]interfa
 		diags.Append(m.Apps.ElementsAs(ctx, &apps, false)...)
 		data["apps"] = apps
 	}
+	// Always sent: the engine only clears a method scope when the key is
+	// present, so an omitted key would leave a previous scope in place.
+	methods := []string{}
+	if !m.Methods.IsNull() && !m.Methods.IsUnknown() {
+		diags.Append(m.Methods.ElementsAs(ctx, &methods, false)...)
+	}
+	data["methods"] = methods
+
 	if !m.TTL.IsNull() && !m.TTL.IsUnknown() {
 		data["ttl"] = m.TTL.ValueInt64()
 	}
@@ -216,6 +240,17 @@ func applyRoleData(m *secretBackendRoleModel, role map[string]interface{}) diag.
 	diags.Append(appDiags...)
 	m.Apps = appSet
 
+	// An unrestricted role reads back as an empty list; keep that as null so a
+	// config that omits methods does not drift against an empty set.
+	methods := toStringSlice(role["methods"])
+	if len(methods) == 0 && (m.Methods.IsNull() || m.Methods.IsUnknown()) {
+		m.Methods = types.SetNull(types.StringType)
+	} else {
+		methodSet, methodDiags := types.SetValueFrom(context.Background(), types.StringType, methods)
+		diags.Append(methodDiags...)
+		m.Methods = methodSet
+	}
+
 	if n, ok := toInt64(role["ttl"]); ok && n != 0 {
 		m.TTL = types.Int64Value(n)
 	} else if m.TTL.IsUnknown() {