Add cert-manager clouddns KV read access for VSO

cert-manager needs a Google Cloud DNS service-account key to solve
Let's Encrypt DNS-01 challenges for publicly-trusted certs. VSO syncs it
from Vault KV, so the cert-manager namespace needs its own k8s auth role
and a policy granting read on the KV path.

- Add k8s auth role cert_manager_clouddns bound to SA
  cert-manager-clouddns in the cert-manager namespace.
- Add policy granting read on
  kv/service/kubernetes/au/syd1/cert-manager/clouddns, bound to that role.

Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT

config/auth_kubernetes_role/k8s/au/syd1/cert_manager_clouddns.yaml

@@ -0,0 +1,7 @@
+bound_service_account_names:
+  - cert-manager-clouddns
+bound_service_account_namespaces:
+  - cert-manager
+token_ttl: 600
+token_max_ttl: 600
+audience: vault

policies/kv/service/kubernetes/au/syd1/cert-manager/clouddns/read.yaml

@@ -0,0 +1,10 @@
+# Allow reading the cert-manager Google Cloud DNS solver service-account key
+---
+rules:
+  - path: "kv/data/service/kubernetes/au/syd1/cert-manager/clouddns"
+    capabilities:
+      - read
+
+auth:
+  k8s/au/syd1:
+    - cert_manager_clouddns