Add identity OIDC token role for terraform-artifactapi (#167)

terraform-artifactapi CI needs a Vault-signed identity token that artifactapi can verify, so the issuer must be a fixed address reachable from pods rather than per-node api_addr.

- set the identity token issuer to https://vault.service.consul:8200
- add RS256 named key artifactapi
- add role terraform-artifactapi (aud artifactapi, 15m ttl)
- grant read on identity/oidc/token/terraform-artifactapi to the terraform_artifactapi approle and woodpecker_terraform_artifactapi k8s role

Requires terraform-vault #165 and #166.

Reviewed-on: #167
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

config/identity_oidc/default.yaml

@@ -0,0 +1,2 @@
+---
+issuer: https://vault.service.consul:8200

config/identity_oidc_key/artifactapi.yaml

@@ -0,0 +1,2 @@
+---
+algorithm: RS256

config/identity_oidc_role/artifactapi/terraform-artifactapi.yaml

@@ -0,0 +1,3 @@
+---
+client_id: artifactapi
+ttl: 900

policies/identity/oidc/token/terraform-artifactapi.yaml

@@ -0,0 +1,11 @@
+---
+rules:
+  - path: "identity/oidc/token/terraform-artifactapi"
+    capabilities:
+      - read
+
+auth:
+  approle:
+    - terraform_artifactapi
+  k8s/au/syd1:
+    - woodpecker_terraform_artifactapi