Add a plugin-import module + config/plugins for catalog registration

Registering a plugin in the catalog is a distinct concern from mounting an
engine, so give it its own module and config directory instead of folding
sha256/command into each engine's backend module.

- Add a generic 'plugin' module (vault_plugin: type/name/command/sha256/
  plugin_version) that imports a binary into the catalog.
- Add a config/plugins/ discovery group (filename = catalog name) and wire it
  through vault_cluster (plugins variable + module) and the syd1 environment.
- Add config/plugins/vault-plugin-secrets-gpg.yaml pinning the released v0.1.0
  binary sha256. Other engines can now register their plugin by dropping a file
  here; their *_secret_backend module just mounts the registered type.

config/config.hcl

@@ -198,5 +198,12 @@ locals {
       })
       if startswith(file_path, "litellm_secret_backend_role/")
     }
+    plugins = {
+      for file_path, content in local.all_configs :
+      trimsuffix(basename(file_path), ".yaml") => merge(content, {
+        name = trimsuffix(basename(file_path), ".yaml")
+      })
+      if startswith(file_path, "plugins/")
+    }
   }
 }