vault: register ghp plugin in the catalog (config/plugins only)

Step 3 of the ordered ghp plugin add: import vault-plugin-secrets-ghp into the
OpenBao secret plugin catalog (type secret, sha256 pins the v0.1.0 binary that
puppet-prod#520 installs). config/plugins/* is generically discovered, so this is
the sole file. Catalog import uses the shared sudo-protected
sys/plugins/catalog grant; no per-engine policy needed here.

Must apply AFTER the binary is installed (puppet#520) and BEFORE the engine
resources (#121) mount+configure it.

config/plugins/vault-plugin-secrets-ghp.yaml

@@ -0,0 +1,11 @@
+# config/plugins/vault-plugin-secrets-ghp.yaml
+# Imports (registers) the ghp secrets plugin in the catalog. Filename =
+# catalog name = mount type. The binary is installed on the OpenBao nodes by
+# Puppet (openbao-plugin-secrets-ghp RPM ->
+# /opt/openbao-plugins/vault-plugin-secrets-ghp).
+#
+# sha256 pins the released v0.1.0 binary; bump it in lockstep with any RPM
+# upgrade or OpenBao will refuse to launch the plugin.
+type: secret
+command: vault-plugin-secrets-ghp
+sha256: "85761421cd532788ed28fb57e93d3868f3577320a538289936d9ed3be5f396de"