Add OpenBao External Secrets lane for Forgejo mailer on railiance01

Introduce external-secrets-forgejo policy/role, ClusterSecretStore
openbao-forgejo (forgejo namespace), and make openbao-configure-external-secrets-forgejo.

openbao/policies/external-secrets-forgejo.hcl

@@ -0,0 +1,13 @@
+# Least-privilege policy for External Secrets Operator Forgejo mailer lane.
+#
+# The matching Kubernetes auth role binds only the ESO service account in the
+# external-secrets namespace. ClusterSecretStore usage is separately limited to
+# the forgejo namespace.
+
+path "platform/data/workloads/forgejo/*" {
+  capabilities = ["read"]
+}
+
+path "platform/metadata/workloads/forgejo/*" {
+  capabilities = ["read", "list"]
+}

openbao/policies/workload-kv-read-forgejo-mailer.hcl

@@ -0,0 +1,7 @@
+path "platform/data/workloads/forgejo/forgejo-mailer" {
+  capabilities = ["read"]
+}
+
+path "platform/metadata/workloads/forgejo/forgejo-mailer" {
+  capabilities = ["read"]
+}