Manage Rancher users, global roles, tokens and settings

Extend the yaml-discovery config to four more rancher2 kinds so Rancher
objects beyond the OIDC auth provider stop being unmanaged clickops.

- Discover config/users, config/roles, config/tokens and config/settings
  in config/config.hcl and pass them through terragrunt.hcl
- Add rancher2_user (password from Vault kv-v2) plus per-user
  rancher2_global_role_binding on "<username>/<role>" keys
- Add rancher2_global_role with dynamic rules blocks
- Add rancher2_token, documenting that the provider has no user selector
- Add rancher2_setting and seed config/settings/server-url.yaml
- Document every yaml schema in the README

config/config.hcl

@@ -13,5 +13,25 @@ locals {
       trimsuffix(basename(file_path), ".yaml") => content
       if startswith(file_path, "global_role_bindings/")
     }
+    users = {
+      for file_path, content in local.all_configs :
+      trimsuffix(basename(file_path), ".yaml") => content
+      if startswith(file_path, "users/")
+    }
+    roles = {
+      for file_path, content in local.all_configs :
+      trimsuffix(basename(file_path), ".yaml") => content
+      if startswith(file_path, "roles/")
+    }
+    tokens = {
+      for file_path, content in local.all_configs :
+      trimsuffix(basename(file_path), ".yaml") => content
+      if startswith(file_path, "tokens/")
+    }
+    settings = {
+      for file_path, content in local.all_configs :
+      trimsuffix(basename(file_path), ".yaml") => content
+      if startswith(file_path, "settings/")
+    }
   }
 }

config/settings/server-url.yaml

@@ -0,0 +1,3 @@
+# Rancher's server-url setting. Must match the URL Rancher is reached on,
+# otherwise newly registered cluster agents dial the wrong endpoint.
+value: https://rancher.k8s.syd1.au.unkin.net