Mirrors the terraform-authentik runner setup (#78/#81/#82) for the new
terraform-rancher repo, which manages Rancher's Authentik OIDC auth via the
rancher2 provider.
- AppRole terraform_rancher + k8s auth role woodpecker_terraform_rancher.
- Consul secret backend role + ACL policy granting write to the
infra/terraform/rancher/ state prefix.
- Vault policies: read the Rancher admin API token
(kv/service/terraform/rancher) and the keycloakoidc client secret
(kv/kubernetes/namespace/cattle-system/default/oauth-credentials), plus the
consul_root state creds.
