Scaffold the ghp Vault secrets engine provider

Model the provider on terraform-provider-giteavaultsecret, adjusting the
schemas to the ghp engine (vault-plugin-secrets-ghp) so its mount, config,
and roles can be managed declaratively.

- Add provider (local name ghpvaultsecret, source
  git.unkin.net/unkin/ghpvaultsecret) with VAULT_ADDR/VAULT_TOKEN fallback.
- Add ghpvaultsecret_secret_backend: mounts the engine and writes config
  (base_url, write-only admin_token, write-only ca_cert, tls_skip_verify,
  request_timeout_seconds); read never returns the sensitive fields.
- Add ghpvaultsecret_secret_role: token_type, installation_id, app_record_id,
  repositories, scopes, session_prefix, ttl, max_ttl; validate that agent
  roles set installation_id.
- Add unit tests for the value conversions and the role/backend field mapping.
- Mirror the woodpecker pre-commit/build/test (PR) and tag release (package +
  PUT zip to the artifactapi terraform registry) pipelines, Makefile version
  bump/package targets, examples, README, and a Docker e2e harness.

examples/resources/ghpvaultsecret_secret_backend/main.tf

@@ -0,0 +1,27 @@
+terraform {
+  required_providers {
+    ghpvaultsecret = {
+      source = "git.unkin.net/unkin/ghpvaultsecret"
+    }
+  }
+}
+
+provider "ghpvaultsecret" {
+  # address / token fall back to VAULT_ADDR / VAULT_TOKEN.
+}
+
+# Mount the ghp secrets engine and seed it with a service token.
+resource "ghpvaultsecret_secret_backend" "ghp" {
+  path     = "ghp"
+  base_url = "https://ghp.unkin.net"
+  ca_cert  = file("${path.module}/ghp-ca.pem")
+
+  admin_token = var.ghp_admin_token # e.g. sourced from vault_kv_secret
+
+  request_timeout_seconds = 30
+}
+
+variable "ghp_admin_token" {
+  type      = string
+  sensitive = true
+}

examples/resources/ghpvaultsecret_secret_role/main.tf

@@ -0,0 +1,14 @@
+# A role that mints short-lived agent tokens bound to a ghp App installation,
+# scoped to contents and pull requests. Reading ghp/creds/ci returns a
+# lease-bound token that ghp revokes when the lease ends.
+resource "ghpvaultsecret_secret_role" "ci" {
+  backend         = ghpvaultsecret_secret_backend.ghp.path
+  name            = "ci"
+  token_type      = "agent"
+  installation_id = 12345
+  repositories    = ["unkin/prodenv"]
+  scopes          = ["contents:read", "pull_requests:write"]
+
+  ttl     = 3600  # 1h
+  max_ttl = 28800 # 8h
+}