The auth/oidc modules in benvin/auth-oidc write auth/oidc/config,
auth/oidc/role/* and external identity groups/aliases. AppRole capabilities
are fixed at login, so the deployer must already hold these grants when that
apply runs.
Add policies/auth/oidc/admin.yaml and policies/identity/group/admin.yaml,
split out of #147 per the never-bundle rule.
