swarm-ci-runner, swarm-grafana, swarm-victorialogs: forward each container's journal to the swarm collector

Each container now runs the journal forwarder the queue's and the builder's
containers run, pushing to a receiver of its own on the swarm collector. Each
authenticates as a new machine OIDC client of its own
(swarm.<service>.otel.clientId), registered by a glue file wherever authelia
runs, minted by authelia and published to the store by the secret publisher.
Grafana's browser login client is unchanged.

The fetch unit inside each container reads the client secret with the store
identity the host already holds for that service (the runner's, Grafana's,
and the log store responder's), now also handed into the container as an
nspawn system credential. Each of those three policies gains one read stanza
on its forwarder's client path. The host units that use those identities are
unchanged.

The three containers drop --link-journal=host, and the host collector stops
reading them.

nix/host-modules/swarm-grafana-service.nix

@@ -37,6 +37,24 @@ in
       '';
     };
 
+    otel.clientId = lib.mkOption {
+      type = lib.types.str;
+      readOnly = true;
+      default = "swarm-grafana-collector";
+      description = ''
+        OAuth2 client id the journal forwarder inside Grafana's container
+        authenticates as, and the audience it asks its token for. Its own,
+        not {option}`services.hyperhive.swarm.grafana.oidc.clientId`, which
+        is the browser login's.
+
+        Read-only because three hosts have to agree on it: authelia
+        registers the client (`glue-grafana-otel-oidc-client.nix`), the
+        swarm collector admits it on the container's receiver
+        (`swarm.otel.serviceProducers`), and the secret publisher carries
+        its secret to the store.
+      '';
+    };
+
     domain = lib.mkOption {
       type = lib.types.str;
       default = "grafana.${domainBase}";