Add artifactapi-writer OIDC role for Woodpecker uploads (#172)

Woodpecker pipelines need a Vault identity OIDC token with audience `artifactapi` to upload artifacts; only terraform-artifactapi can mint one today.

- add `artifactapi-writer` identity OIDC role (client_id artifactapi, ttl 900)
- add policy granting read on `identity/oidc/token/artifactapi-writer` to k8s role `woodpecker_artifactapi_writer`, vault admins via oidc/ldap
- add k8s auth role `woodpecker_artifactapi_writer` bound to woodpecker CI service accounts

Reviewed-on: #172
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

config/auth_kubernetes_role/k8s/au/syd1/woodpecker_artifactapi_writer.yaml

@@ -0,0 +1,15 @@
+bound_service_account_names:
+  - default
+  - arrproxy-ci
+  - autobackup-operator-ci
+  - ghp
+  - jellyfin-plugin-sso
+  - kea-operator-ci
+  - mediamark-ci
+  - plugin-docker-buildx
+  - repospawner-ci
+bound_service_account_namespaces:
+  - woodpecker
+token_ttl: 600
+token_max_ttl: 600
+audience: https://kubernetes.default.svc.cluster.local

config/identity_oidc_role/artifactapi/artifactapi-writer.yaml

@@ -0,0 +1,3 @@
+---
+client_id: artifactapi
+ttl: 900

policies/identity/oidc/token/artifactapi-writer.yaml

@@ -0,0 +1,13 @@
+---
+rules:
+  - path: "identity/oidc/token/artifactapi-writer"
+    capabilities:
+      - read
+
+auth:
+  k8s/au/syd1:
+    - woodpecker_artifactapi_writer
+  ldap:
+    - vault_admin
+  oidc:
+    - akP-vault-admin