Register + mount the GPG secrets engine at gpg/ (#87)

Complete the deploy of the [vault-plugin-secrets-gpg](https://git.unkin.net/unkin/vault-plugin-secrets-gpg) engine. Puppet ([puppet-prod #480](unkin/puppet-prod#480)) installs the `openbao-plugin-secrets-gpg` RPM onto the OpenBao nodes; this registers that binary in the plugin catalog and enables the secrets engine so `gpg/` is actually usable.

- Add a `gpg_secret_backend` module using the standard `hashicorp/vault` provider (already required at 5.6.0): `vault_plugin` (catalog register with a pinned sha256) + `vault_mount` (enable at the mount path).
- Wire it through `vault_cluster` (new `gpg_secret_backend` variable + module block) and the config discovery (`config.hcl` group + syd1 terragrunt input), mirroring `litellm_secret_backend`.
- Add `config/gpg_secret_backend/gpg.yaml` mounting at `gpg/` and pinning the released v0.1.0 binary sha256 (`0e92d740…a7b20`, extracted from the published RPM). Puppet installs the RPM floating, so this sha must be bumped in lockstep on any plugin upgrade or OpenBao rejects the binary.

Validated locally with `tofu validate` + `tofu fmt`. Granting non-root access to `gpg/*` (auth roles + policies) is a follow-up scoped to whoever consumes the engine (e.g. passv from CI).

Reviewed-on: #87
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>

modules/vault_cluster/main.tf

@@ -346,6 +346,34 @@ module "plugin" {
   plugin_version = each.value.version
 }
 
+module "gpg_secret_backend" {
+  source = "./modules/gpg_secret_backend"
+
+  for_each = var.gpg_secret_backend
+
+  path        = each.key
+  plugin      = each.value.plugin
+  description = each.value.description
+
+  depends_on = [module.plugin]
+}
+
+module "gpg_key" {
+  source = "./modules/gpg_key"
+
+  for_each = var.gpg_key
+
+  backend                = each.value.backend
+  name                   = each.value.name
+  algorithm              = each.value.algorithm
+  identity               = each.value.identity
+  exportable             = each.value.exportable
+  deletion_allowed       = each.value.deletion_allowed
+  min_decryption_version = each.value.min_decryption_version
+
+  depends_on = [module.gpg_secret_backend]
+}
+
 module "vault_policy" {
   source = "./modules/vault_policy"