Add Openbao root token generation runbooks

What does this MR do?

Adds a Generate a root token section to the Secrets Manager GKE runbook, under Troubleshooting.

• Table of the per-environment values: Teleport role, console host, OpenBao URL, 1Password vault
• Steps: run recovery_key:generate_root_token on the console host, then on your computer verify the token with bao, do the operation (example: update an ACL policy), and revoke the token

It links to the self-managed docs for how the Rake task works and to the Teleport runbook for access, instead of repeating them.

Why

The self-managed docs verify and revoke the token with kubectl exec into the OpenBao pod. GitLab.com kubectl access is read-only with no exec, so these steps run the bao CLI on your computer against the public OpenBao URL instead. This follows the Vault root token runbook (docs/vault/troubleshooting.md), which also runs the CLI locally. The change request step follows docs/sscs/auth/cloud-connector.md, another Rake task run on a console host.

Related: gitlab-org/gitlab#608230 (closed)

Testing

• Ran every bao step as written in bash and zsh against OpenBao v2.6.2 on GDK: token check, policy read, edit and write, revoke, then lookup returns 403
• bao status from my laptop reaches both https://secrets.staging.gitlab.com and https://secrets.gitlab.com without VPN or proxy