swarm-bao, swarm: give the secret publisher its own subject, reserved like the controller's

The unit that will copy authelia's minted OIDC client secrets into the store
needs an identity of its own. Not the controller's: that grant includes
rewriting every hive's policy and login role, which a unit whose whole job is
copying one file has no business holding.

The subject joins `certAuthCns`, so it is unrepresentable as a hive name for
the same reason the controller's is — cert auth trusts the CA, and a hive's
own leaf carries its name as the CN.

The module-eval case collides with the SECOND list element and leaves the
controller's subject at its default. A list with one consulted element and one
dead one is indistinguishable from the first element's case, so without this
the addition could be inert and nothing would say so.

Refs #3853

nix/host-modules/swarm.nix

@@ -43,7 +43,10 @@ let
   # every role added beside these widens what a hive name must not collide
   # with. A hive's own leaf carries its name as the CN, so a hive named after
   # one of these presents a certificate that role accepts.
-  certAuthCns = [ deployCfg.bao.controllerCommonName ];
+  certAuthCns = [
+    deployCfg.bao.controllerCommonName
+    deployCfg.bao.secretPublisherCommonName
+  ];
 
   # Public hostnames of the swarm's own services, in declaration order.
   # `serviceDomains` below is this set sorted + deduplicated.