name the mint, not the publisher, as the writer of the client secrets

Finishes the sweep of prose that said the publisher unit writes or carries the OIDC client secrets: rust docs, nix comments and option descriptions, test names and docs.

nix/module-eval/bao-grants.nix

@@ -2417,7 +2417,7 @@ let
         && !(lib.hasInfix "appservice-registration" baoGrantHere.systemd.services.swarm-bao-controller-policy.script);
     }
     {
-      # The controller's own OIDC client secret, which the publisher writes and
+      # The controller's own OIDC client secret, which authelia's mint writes and
       # the controller reads at start. Pinned as the whole stanza, so an added
       # capability fails.
       name = "the controller reads its own client secret and cannot write it";