Add OpenBao External Secrets lane for Forgejo mailer on railiance01

Introduce external-secrets-forgejo policy/role, ClusterSecretStore
openbao-forgejo (forgejo namespace), and make openbao-configure-external-secrets-forgejo.

argocd/platform-addons/openbao-secretstore/kustomization.yaml

@@ -4,3 +4,4 @@ kind: Kustomization
 resources:
   - openbao.clustersecretstore.yaml
   - openbao-activity-core.clustersecretstore.yaml
+  - openbao-forgejo.clustersecretstore.yaml

argocd/platform-addons/openbao-secretstore/openbao-forgejo.clustersecretstore.yaml

@@ -0,0 +1,23 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ClusterSecretStore
+metadata:
+  name: openbao-forgejo
+  labels:
+    app.kubernetes.io/part-of: railiance-gitops
+    railiance-platform/component: external-secrets
+spec:
+  provider:
+    vault:
+      server: http://openbao.openbao.svc.cluster.local:8200
+      path: platform
+      version: v2
+      auth:
+        kubernetes:
+          mountPath: kubernetes
+          role: external-secrets-forgejo
+          serviceAccountRef:
+            name: external-secrets
+            namespace: external-secrets
+  conditions:
+    - namespaces:
+        - forgejo