add external gitlab accounts: stored in bao, linked per agent, allowed in squid, usable with glab

nix/host-modules/swarm-bao.nix

@@ -402,8 +402,8 @@ let
 
   # The two `list` paths end in `/`: bao checks a LIST against the directory
   # with a trailing slash, where `+` matches the empty last segment, so a
-  # slashless list path loses that request to the `+/matrix/+` and `+/forge/+`
-  # delete stanzas and the LIST is denied.
+  # slashless list path loses that request to the `+/matrix/+`, `+/forge/+`
+  # and `+/gitlab/+` delete stanzas and the LIST is denied.
   controllerPolicyText = ''
     path "auth/cert/certs/hive-*" {
       capabilities = ["create", "update", "read", "delete"]
@@ -472,6 +472,10 @@ let
       capabilities = ["list"]
     }
 
+    path "${credentialMountPath}/metadata/swarm/agents/+/gitlab/" {
+      capabilities = ["list"]
+    }
+
     path "${credentialMountPath}/metadata/swarm/agents/+/matrix/+" {
       capabilities = ["delete"]
     }
@@ -480,6 +484,10 @@ let
       capabilities = ["delete"]
     }
 
+    path "${credentialMountPath}/metadata/swarm/agents/+/gitlab/+" {
+      capabilities = ["delete"]
+    }
+
     path "${credentialMountPath}/metadata/swarm/agents/+/github-token" {
       capabilities = ["delete"]
     }