Grant terraform-incus approle read on encapi environment secret

terraform-incus dual-writes ENC data to encapi and needs the
ENCAPI_WRITE_TOKEN from Vault at apply time. Add a policy granting the
terraform_incus approle read on kv/data/kubernetes/namespace/encapi/default/environment.

Prerequisite for terraform-incus PR #39.

policies/kv/service/terraform/incus-encapi-environment.yaml

@@ -0,0 +1,12 @@
+# Allow the Terraform Incus runner to read the encapi environment secret
+# (ENCAPI_WRITE_TOKEN), so `make apply` can dual-write ENC data to encapi via
+# the encapi Terraform provider.
+---
+rules:
+  - path: "kv/data/kubernetes/namespace/encapi/default/environment"
+    capabilities:
+      - read
+
+auth:
+  approle:
+    - terraform_incus