feat(vault): reorganize secrets with fine-grained policies

[minmzzhang]

Reorganize Vault secrets into segmented paths for least-privilege access:

Secret Path Structure:

• apps// - Application-specific secrets (e.g., apps/qtodo/)
• hub/infra// - Infrastructure secrets (e.g., hub/infra/keycloak/)
• global/ - Shared secrets (unchanged)
• hub/ - Hub-level secrets (unchanged)

Policy Naming Convention:

• K8s auth policies: -k8s-secret (for ClusterSecretStore/ExternalSecrets)
• JWT auth policies: -jwt-secret (for SPIFFE workload identity)

Changes:

• Update vaultPrefixes in values-secret.yaml.template for new paths
• Update ExternalSecret references in chart values.yaml files
• Add JWT policies to values-hub.yaml for SPIFFE workload authentication
• Pass JWT policies to vault-config-jwt ansible task via vault-utils.sh

This enables application-level secret isolation where each app only has access to its own secrets, following zero-trust principles.

Depends on: rhvp/rhvp.cluster_utils PR for auto-creating K8s auth policies

Secrets Structure

secret/data/
├── global/                           # VP Framework Default
│   └── config-demo/                  # Demo/test secrets
│       └── secret
│
├── apps/                             # Application Secrets (fine-grained isolation)
│   └── qtodo/                        # QTodo Application
│       ├── qtodo-db/                 # Database credentials
│       │   ├── admin-password
│       │   └── db-password
│       ├── qtodo-oidc-client/        # OIDC client secret
│       │   └── client-secret
│       └── qtodo-truststore/         # Truststore password
│           └── truststore-password
│
└── hub/                              # Hub Infrastructure Secrets
    └── infra/
        ├── keycloak/                 # Keycloak Infrastructure
        │   └── keycloak/
        │       ├── admin-password
        │       └── db-password
        │
        ├── rhtpa/                    # RHTPA Infrastructure
        │   ├── rhtpa-db/
        │   │   └── db-password
        │   └── rhtpa-oidc-cli/
        │       └── client-secret
        │
        ├── users/                    # User Credentials (managed by Keycloak)
        │   └── keycloak-users/
        │       ├── qtodo-admin-password
        │       ├── qtodo-user1-password
        │       ├── rhtas-user-password
        │       └── rhtpa-user-password
        │
        └── quay/                     # Quay Registry
            └── quay-users/
                ├── quay-admin-password
                └── quay-user-password