Add on-tag RPM build (nfpm) and upload to artifactapi

Publish the plugin as an installable RPM so hosts can drop it into the Vault/
OpenBao plugin directory. On a tag, build the binary, package it with nfpm
(mirroring the rpmbuilder approach), and upload the RPM to artifactapi's local
rpm-internal repository.

- Add packaging/nfpm.yaml installing the binary to /opt/vault-plugins/ plus a
  preinstall script that creates the directory
- Add scripts/build-rpm.sh and make rpm / rpm-package targets
- Add .woodpecker/release.yml (event: tag): build -> nfpm package -> PUT to
  artifactapi remotes/rpm-internal/files/

packaging/scripts/preinstall.sh

@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+# Ensure the plugin directory exists before the binary is laid down.
+mkdir -p /opt/vault-plugins