Let terraform-authentik read the vlogs OIDC client secret (#157)

vlogs is the first app needing a second OIDC secret in a namespace that already has one, so the one-per-namespace `oauth-credentials` wildcard does not cover it and the terraform-authentik plan fails on a denied kv read.

- grant the runner read on `kv/kubernetes/namespace/logging/default/vlogs-oauth-credentials`

Unblocks terraform-authentik #40.

Reviewed-on: #157
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

policies/kv/service/terraform/authentik.yaml

@@ -10,6 +10,11 @@ rules:
   - path: "kv/data/kubernetes/namespace/+/default/oauth-credentials"
     capabilities:
       - read
+  # Second OIDC client in an already-onboarded namespace, so it cannot use the
+  # one-per-namespace oauth-credentials path above.
+  - path: "kv/data/kubernetes/namespace/logging/default/vlogs-oauth-credentials"
+    capabilities:
+      - read
 
 auth:
   approle: