Grant the vault deployer sudo to enable the oidc auth mount (#149)

## Why

The deployer identities cannot enable the `oidc` auth mount: `POST /v1/sys/auth/oidc` returns 403 because `sys/auth/<path>` (and its `/tune`) is sudo-protected, and `policies/sys/auth/admin.yaml` granted create/update/delete/read/list without `sudo`.

## How

- Add exact-path rules for `sys/auth/oidc` and `sys/auth/oidc/tune` to `policies/sys/auth/admin.yaml` with the wildcard's capability set plus `sudo` (exact match wins over the glob, so the set is repeated in full); auth block unchanged.

Merge order: apply this, then re-run the master apply so `module.auth_oidc_backend["oidc"]` can create the mount.

Reviewed-on: #149
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

policies/sys/auth/admin.yaml

@@ -8,6 +8,24 @@ rules:
       - delete
       - read
       - list
+  # Enabling/tuning an auth mount is sudo-protected, and an exact path match
+  # wins over the wildcard above, so both rules repeat the full capability set.
+  - path: "sys/auth/oidc"
+    capabilities:
+      - create
+      - update
+      - delete
+      - read
+      - list
+      - sudo
+  - path: "sys/auth/oidc/tune"
+    capabilities:
+      - create
+      - update
+      - delete
+      - read
+      - list
+      - sudo
 
 auth:
   approle: