Add encapi identity OIDC key and roles (#170)

encapi moves to Vault identity OIDC auth, mirroring artifactapi: terraform-enc gets full write tokens, and admins can mint narrow encapi-testing tokens that may only switch a node to the testing environment.

- add RS256 identity OIDC key `encapi`
- add role `terraform-enc` (aud `encapi`) readable by approle `terraform_enc` and k8s `woodpecker_terraform_enc`
- add role `encapi-testing` (aud `encapi-testing`) readable by ldap `vault_admin` and oidc `akP-vault-admin`

Reviewed-on: #170
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

config/identity_oidc_key/encapi.yaml

@@ -0,0 +1,2 @@
+---
+algorithm: RS256

config/identity_oidc_role/encapi/encapi-testing.yaml

@@ -0,0 +1,3 @@
+---
+client_id: encapi-testing
+ttl: 900

config/identity_oidc_role/encapi/terraform-enc.yaml

@@ -0,0 +1,3 @@
+---
+client_id: encapi
+ttl: 900

policies/identity/oidc/token/encapi-testing.yaml

@@ -0,0 +1,11 @@
+---
+rules:
+  - path: "identity/oidc/token/encapi-testing"
+    capabilities:
+      - read
+
+auth:
+  ldap:
+    - vault_admin
+  oidc:
+    - akP-vault-admin

policies/identity/oidc/token/terraform-enc.yaml

@@ -0,0 +1,11 @@
+---
+rules:
+  - path: "identity/oidc/token/terraform-enc"
+    capabilities:
+      - read
+
+auth:
+  approle:
+    - terraform_enc
+  k8s/au/syd1:
+    - woodpecker_terraform_enc