swarm-controller: hand the daemon the authority hives are issued from

Creating a hive's cert-auth role means writing the authority into the role
by value -- the store matches a presented certificate against the role's own
copy -- and nothing gave this daemon that file.

Named separately from deploy.bao.clientCaFile rather than read off it: that
option is the store's, saying which readers the store trusts on the host
that runs it, while a controller runs anywhere. The glue module supplies it
where the two are co-located, which is the same split baoClientCertFile
already makes against the hive reader's leaf.

Gated on the identity as well as the CA. Without a leaf there is nothing to
write a role with, so the file would reach a daemon that cannot act on it.

The module-eval arm needed a fixture of its own: a deployment that
self-signs both ends points clientCaFile and serverCaFile at one file, so on
the existing fixture the two authorities are the same string and wiring
either into the other's slot passes. controllerTwoCas is where they differ.

nix/host-modules/glue-controller-bao-identity.nix

@@ -36,6 +36,12 @@ in
     services.hyperhive.deploy.swarm-controller = {
       baoClientCertFile = lib.mkDefault "${pkiDir}/controller.pem";
       baoClientKeyFile = lib.mkDefault "${pkiDir}/controller-key.pem";
+    }
+    // lib.optionalAttrs (baoDeploy.clientCaFile != null) {
+      # The authority the store already trusts hives by, handed to the daemon
+      # that has to write it into each hive's role. One file, two readers —
+      # a second copy would authenticate hives the store does not.
+      hiveClientCaFile = lib.mkDefault baoDeploy.clientCaFile;
     };
   };
 }