feat: add vault policy for terraform-git webhook secrets (#75)

## Summary
- Add read policy for kv/data/service/gitea/webhook/* path
- Assigned to terraform_git approle and woodpecker_terraform_git k8s auth role
- Webhook URLs are stored in Vault KV and read at plan/apply time

## Test plan
- [ ] Verify terragrunt plan succeeds for terraform-git after merge

Reviewed-on: #75
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>

policies/kv/service/woodpecker/tokens/gitadmin.yaml

@@ -0,0 +1,11 @@
+---
+rules:
+  - path: "kv/data/service/woodpecker/tokens/gitadmin"
+    capabilities:
+      - read
+
+auth:
+  approle:
+    - terraform_git
+  k8s/au/syd1:
+    - woodpecker_terraform_git