swarm-bao: give the store forwarder's OIDC reader its own bao identity

`swarm-bao-forwarder-oidc` fetches the store container's collector secret,
one path, and was the last reader still logging in with
`deploy.bao.clientCertFile`: the hive's own leaf, whose policy reads every
agent's credentials, the hive's tree and every service's OIDC secret. The
four-way split gave grafana's and the swarm collector's readers leaves of
their own and left this one behind.

It now holds `forwarder-oidc.pem`, minted by `swarm-bao-pki`, and logs in
under the `swarm-forwarder-oidc` cert-auth role, whose policy reads
`secret/data/swarm/services/<store forwarder client id>/oidc/client` and
nothing else. The role is written by `swarm-bao-forwarder-oidc-policy`
from the bootstrap token, which gains the two grants that unit calls, and
the reader is ordered after it. The subject is reserved as a hive name. A
store host whose pair is null is refused at eval rather than falling back
to the hive's leaf.

The hive's own role and `client.pem` are untouched; nothing is revoked.

nix/host-modules/swarm-bao-bootstrap-policy.hcl

@@ -116,6 +116,15 @@ path "auth/cert/certs/swarm-otel-oidc" {
   capabilities = ["create", "update"]
 }
 
+# swarm-bao-forwarder-oidc-policy
+path "sys/policies/acl/swarm-forwarder-oidc" {
+  capabilities = ["create", "update"]
+}
+
+path "auth/cert/certs/swarm-forwarder-oidc" {
+  capabilities = ["create", "update"]
+}
+
 # swarm-bao-nats-tls-policy: the queue's own pki role, beside
 # `swarm-services` above, and its policy and login role.
 path "pki/roles/swarm-nats" {