Build an OpenBao RPM alongside the Vault one

The plugin runs under both Vault and OpenBao, but nfpm only produced a
single RPM that installs into /opt/vault-plugins. OpenBao hosts expect
their plugins under /opt/openbao-plugins, so a second package is needed.

- Parameterize nfpm.yaml with PACKAGE_NAME, PACKAGE_PLUGIN_DIR, and
  PACKAGE_PREINSTALL so one config renders per target server
- Replace the static preinstall.sh with preinstall.sh.tmpl that
  mkdir -p's the flavour's plugin directory
- Build two RPMs in build-rpm.sh via a build_flavor helper:
  vault-plugin-secrets-litellm -> /opt/vault-plugins and
  openbao-plugin-secrets-litellm -> /opt/openbao-plugins

scripts/build-rpm.sh

@@ -1,6 +1,8 @@
 #!/usr/bin/env bash
 #
-# Package the (already built) plugin binary into an RPM with nfpm.
+# Package the (already built) plugin binary into RPMs with nfpm.
+# Builds one RPM per target server: Vault (/opt/vault-plugins) and
+# OpenBao (/opt/openbao-plugins). Both wrap the same binary.
 # Usage: scripts/build-rpm.sh [version]   (version defaults to $CI_COMMIT_TAG)
 #
 set -euo pipefail
@@ -18,7 +20,7 @@ if [ ! -f "${DIST}/${BINARY}" ]; then
   exit 1
 fi
 
-export PACKAGE_NAME="${BINARY}"
+# Fields shared across every flavour.
 export PACKAGE_VERSION="${VERSION}"
 export PACKAGE_RELEASE="1"
 export PACKAGE_ARCH="amd64"
@@ -28,8 +30,20 @@ export PACKAGE_MAINTAINER="Ben Vincent <ben@unkin.net>"
 export PACKAGE_HOMEPAGE="https://git.unkin.net/unkin/vault-plugin-secrets-litellm"
 export PACKAGE_LICENSE="MIT"
 
-envsubst < packaging/nfpm.yaml > "${DIST}/nfpm.yaml"
-nfpm pkg --config "${DIST}/nfpm.yaml" --target "${DIST}" --packager rpm
+# build_flavor <package-name> <plugin-dir>
+build_flavor() {
+  export PACKAGE_NAME="$1"
+  export PACKAGE_PLUGIN_DIR="$2"
+  export PACKAGE_PREINSTALL="${DIST}/preinstall-${PACKAGE_NAME}.sh"
+
+  envsubst '${PACKAGE_PLUGIN_DIR}' \
+    < packaging/scripts/preinstall.sh.tmpl > "${PACKAGE_PREINSTALL}"
+  envsubst < packaging/nfpm.yaml > "${DIST}/nfpm-${PACKAGE_NAME}.yaml"
+  nfpm pkg --config "${DIST}/nfpm-${PACKAGE_NAME}.yaml" --target "${DIST}" --packager rpm
+}
+
+build_flavor "vault-plugin-secrets-litellm"   "/opt/vault-plugins"
+build_flavor "openbao-plugin-secrets-litellm" "/opt/openbao-plugins"
 
 echo "Built:"
 ls -1 "${DIST}"/*.rpm