swarm-bao: give the store forwarder's OIDC reader its own bao identity

`swarm-bao-forwarder-oidc` fetches the store container's collector secret,
one path, and was the last reader still logging in with
`deploy.bao.clientCertFile`: the hive's own leaf, whose policy reads every
agent's credentials, the hive's tree and every service's OIDC secret. The
four-way split gave grafana's and the swarm collector's readers leaves of
their own and left this one behind.

It now holds `forwarder-oidc.pem`, minted by `swarm-bao-pki`, and logs in
under the `swarm-forwarder-oidc` cert-auth role, whose policy reads
`secret/data/swarm/services/<store forwarder client id>/oidc/client` and
nothing else. The role is written by `swarm-bao-forwarder-oidc-policy`
from the bootstrap token, which gains the two grants that unit calls, and
the reader is ordered after it. The subject is reserved as a hive name. A
store host whose pair is null is refused at eval rather than falling back
to the hive's leaf.

The hive's own role and `client.pem` are untouched; nothing is revoked.

nix/module-eval/bao-otel-collector.nix

@@ -382,7 +382,7 @@ let
     }
     {
       # Same 403-not-a-miss property the grafana and matrix readers are pinned
-      # for: the reader's grant covers the `services` prefix, so a secret
+      # for: the reader's grant is one path under `services`, so a secret
       # filed under the hive that happens to run the store would be refused
       # rather than missing, however correct the path reads.
       name = "the forwarder's secret is read from the prefix the publisher writes";