Grant the vault deployer sudo to enable the oidc auth mount

Enabling and tuning an auth mount at sys/auth/<path> is sudo-protected, so
the deployer identities got 403 on POST /v1/sys/auth/oidc despite already
holding create/update/delete on sys/auth/*.

policies/sys/auth/admin.yaml

@@ -8,6 +8,24 @@ rules:
       - delete
       - read
       - list
+  # Enabling/tuning an auth mount is sudo-protected, and an exact path match
+  # wins over the wildcard above, so both rules repeat the full capability set.
+  - path: "sys/auth/oidc"
+    capabilities:
+      - create
+      - update
+      - delete
+      - read
+      - list
+      - sudo
+  - path: "sys/auth/oidc/tune"
+    capabilities:
+      - create
+      - update
+      - delete
+      - read
+      - list
+      - sudo
 
 auth:
   approle: