Mount the gpg engine and manage a 'pass' key

Mount the gpg secrets engine (the plugin is registered separately via the
plugin module + config/plugins, #89) and manage OpenPGP keys with the
gpgvaultsecret provider.

- gpg_secret_backend module: mounts the registered plugin type; depends_on the
  plugin module so the mount waits for catalog registration.
- gpg_key module (via the gpgvaultsecret provider, registered in root.hcl):
  create/configure keys; wired through vault_cluster + config discovery
  (config/gpg_key/<backend>/<name>.yaml).
- config/gpg_secret_backend/gpg.yaml mounts at gpg/; config/gpg_key/gpg/pass.yaml
  is an rsa-4096 'pass' key for password-store (private key stays in Vault;
  clients decrypt via gpg/decrypt/pass).

Rebased onto master after the access (#88) and plugin-import (#89) PRs merged.

config/config.hcl

@@ -205,5 +205,18 @@ locals {
       })
       if startswith(file_path, "plugins/")
     }
+    gpg_secret_backend = {
+      for file_path, content in local.all_configs :
+      trimsuffix(basename(file_path), ".yaml") => content
+      if startswith(file_path, "gpg_secret_backend/")
+    }
+    gpg_key = {
+      for file_path, content in local.all_configs :
+      trimsuffix(replace(file_path, "gpg_key/", ""), ".yaml") => merge(content, {
+        name    = trimsuffix(basename(file_path), ".yaml")
+        backend = dirname(replace(file_path, "gpg_key/", ""))
+      })
+      if startswith(file_path, "gpg_key/")
+    }
   }
 }

config/gpg_key/gpg/pass.yaml

@@ -0,0 +1,7 @@
+# config/gpg_key/gpg/pass.yaml
+# An OpenPGP key in the gpg engine for password-store (passv). The private key
+# stays in Vault; clients import the exported public key to encrypt and delegate
+# decryption to gpg/decrypt/pass. Key name = "pass", backend = "gpg".
+algorithm: rsa-4096
+identity: "pass <pass@unkin.net>"
+exportable: false

config/gpg_secret_backend/gpg.yaml

@@ -0,0 +1,4 @@
+# config/gpg_secret_backend/gpg.yaml
+# Mounts the gpg secrets engine at "gpg". The plugin itself is registered in the
+# catalog separately (see config/plugins/vault-plugin-secrets-gpg.yaml).
+description: "GPG/OpenPGP secrets engine (sign/verify/encrypt/decrypt)"