feat: add Kubernetes workload roles

[glitchedmob]

Adds least-privilege IAM roles for cluster workloads that read SGF Devs Parameter Store values.

• Grants External Secrets read access to the infra-vm-workloads SSM path.
• Grants OpenBao read access only to its unseal-key parameter.
• Restricts each trust policy to its exact Kubernetes service account.

[github-actions]

Terraform plan

Artifacts: https://github.com/sgfdevs/infra-vm-workloads/actions/runs/33288267204

Show summary

CHANGE	RESOURCE
add (4)	aws_iam_role.external_secrets
	aws_iam_role.openbao
	aws_iam_role_policy.external_secrets
	aws_iam_role_policy.openbao

CHANGE	OUTPUT
add (2)	sgfdevs_k3s_external_secrets_workload_role_arn
	sgfdevs_k3s_openbao_workload_role_arn

Decrypt artifacts:
openssl enc -d -aes-256-cbc -pbkdf2 -in tfplan.enc -out tfplan -pass pass:$OUTPUT_ENCRYPTION_KEY
openssl enc -d -aes-256-cbc -pbkdf2 -in tfplan.txt.enc -out tfplan.txt -pass pass:$OUTPUT_ENCRYPTION_KEY

[glitchedmob]

Coordination: merge and apply sgfdevs/infra-aws-core#5 before applying this PR.