FEAT(vault): add OIDC auth for Authelia SSO

- Add ExternalSecret for VAULT_CLIENT_SECRET
- Configure default and admin roles for OIDC login
- Fix claim settings (use sub instead of preferred_username)
- Remove oidc-setup-job (already configured)

vault/kustomization.yaml

@@ -4,3 +4,5 @@ resources:
 - manifests/cluster-secret-store.yaml
 - manifests/external-secret.yaml
 - manifests/rbac.yaml
+- manifests/oidc-secret.yaml
+- manifests/oidc-setup-job.yaml