swarm: publish minted OIDC client secrets into the swarm store

A hive that does not host authelia has no path to its own agent queue
client secret. The mint writes the plaintext to a host directory whose
other reader lives in a different container, so the host that mints is
the only place both trees are addressable — which is where this unit
runs.

Four pieces, in the order they depend on each other: the leaf
(glue-bao-tls.nix signs it, because the thing that owns a private key
owns issuing from it), the module declaring its own cert/key options,
the one-pairing glue file pointing them at that leaf, and the imports.

The unit is gated on holding a client identity, never on
deploy.bao.enable — that option is the co-location assumption itself,
and the publisher is the case that assumption excludes.

The secret is passed to bao as `value=@<path>`, never as an argv
element: bao is an external binary, so an argument is world-readable in
/proc for the life of the call.

Refs #3853

nix/host-modules/glue-bao-tls.nix

@@ -140,6 +140,13 @@ in
         # this hive's name.
         [ -s ${pkiDir}/controller.pem ] || ${signLeaf} ${pkiDir} controller \
           ${lib.escapeShellArg deployCfg.bao.controllerCommonName} "" clientAuth
+
+        # The secret publisher's, minted here for the reason the controller's
+        # line above gives — and it serves that case more often, not less: the
+        # publisher runs beside AUTHELIA, which is the one host guaranteed not
+        # to be this one whenever the store has a host of its own.
+        [ -s ${pkiDir}/secret-publisher.pem ] || ${signLeaf} ${pkiDir} secret-publisher \
+          ${lib.escapeShellArg deployCfg.bao.secretPublisherCommonName} "" clientAuth
       '';
     };
   };