swarm: publish minted OIDC client secrets into the swarm store

A hive that does not host authelia has no path to its own agent queue
client secret. The mint writes the plaintext to a host directory whose
other reader lives in a different container, so the host that mints is
the only place both trees are addressable — which is where this unit
runs.

Four pieces, in the order they depend on each other: the leaf
(glue-bao-tls.nix signs it, because the thing that owns a private key
owns issuing from it), the module declaring its own cert/key options,
the one-pairing glue file pointing them at that leaf, and the imports.

The unit is gated on holding a client identity, never on
deploy.bao.enable — that option is the co-location assumption itself,
and the publisher is the case that assumption excludes.

The secret is passed to bao as `value=@<path>`, never as an argv
element: bao is an external binary, so an argument is world-readable in
/proc for the life of the call.

Refs #3853

nix/host-modules/default.nix

@@ -26,9 +26,11 @@
     ./glue-bao-tls.nix
     ./glue-controller-bao-identity.nix
     ./glue-matrix-bao-token.nix
+    ./glue-secret-publisher-bao-identity.nix
     ./swarm-authelia.nix
     ./swarm-bao.nix
     ./swarm-ca.nix
+    ./swarm-secret-publisher.nix
     ./swarm-nats.nix
     ./swarm-controller.nix
     ./swarm-grafana.nix