Name the SSH host sign policy after its sshca role

The only role on the sshca mount is signhost, so a policy granting the
literal path sshca/sign/host matches no role and every host signing
request is denied after a successful login.

- Rename the policy to sshca/sign/signhost and grant that path
- Move the policy's state to the new name so the rename is tracked

modules/vault_cluster/state_migrations.tf

@@ -338,6 +338,12 @@ moved {
   to   = module.vault_policy["sshca/sign/host"].vault_policy.this
 }
 
+# The SSH host signing policy is named after the sshca role it grants (signhost)
+moved {
+  from = module.vault_policy["sshca/sign/host"].vault_policy.this
+  to   = module.vault_policy["sshca/sign/signhost"].vault_policy.this
+}
+
 moved {
   from = vault_policy.policies["sys/sys_audit_read"]
   to   = module.vault_policy["sys/audit/read"].vault_policy.this

policies/sshca/sign/signhost.yaml

@@ -1,7 +1,7 @@
 # Allow signing SSH host certificates
 ---
 rules:
-  - path: "sshca/sign/host"
+  - path: "sshca/sign/signhost"
     capabilities:
       - create
       - update