Introduce external-secrets-forgejo policy/role, ClusterSecretStore openbao-forgejo (forgejo namespace), and make openbao-configure-external-secrets-forgejo.