policies: grant terraform-git read on the gitea config KV metadata path (#103)

terraform-git's main apply still fails after the skip_child_token fix (tfgit #48): the vault_kv_secret_v2 seed resource reads the kv-v2 metadata path during plan/apply, and the grant added in #102 covered kv/data only — Vault returns 403 on GET kv/metadata/.../secret_backend/gitea/config (terraform-git pipeline 107). This is the last blocker before the KV seed lands and terraform-vault #101 can apply.

- add read on kv/metadata/service/vault/au/syd1/secret_backend/gitea/config to the terraform-git seed policy

Reviewed-on: #103
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>

policies/kv/service/vault/au/syd1/secret_backend/gitea/config_write.yaml

@@ -12,6 +12,11 @@ rules:
       - create
       - read
       - update
+  # vault_kv_secret_v2 also reads the kv-v2 metadata path on every plan/apply
+  # (403 here broke the terraform-git main apply, pipeline 107).
+  - path: "kv/metadata/service/vault/au/syd1/secret_backend/gitea/config"
+    capabilities:
+      - read
 
 auth:
   approle: