terraform-incus dual-writes ENC data to encapi and needs the
ENCAPI_WRITE_TOKEN from Vault at apply time. Add a policy granting the
terraform_incus approle read on kv/data/kubernetes/namespace/encapi/default/environment.
Prerequisite for terraform-incus PR #39.
