Add rake task to generate an OpenBao root token

What does this MR do and why?

• Part of #608230 (closed)
• The documented way to generate an OpenBao root token from the recovery key (bao operator generate-root) no longer works. OpenBao v2.5.3 turned the unauthenticated sys/generate-root/* endpoints off by default and OpenBao v2.6.0 added the authenticated sys/generate-root-token/* endpoints as the replacement. They need both the JWT and the recovery key
• This MR adds the gitlab:secrets_management:openbao:root_token:generate Rake task. It authenticates with the privileged GitLab JWT and uses the recovery key stored in GitLab. If no key is stored, it asks for it
• Updates the recovery key docs to use the new task

References

• Issue - #608230 (closed)
• OpenBao deprecation of the unauthenticated generate root endpoints - https://openbao.org/community/deprecation/
• Runbook update for .com - gitlab-com/runbooks!11660 (merged)

How to set up and validate locally

Needs OpenBao v2.6.x with a recovery key. master pins v2.6.2-gitlab1.

1. Store a recovery key

   gitlab-rake "gitlab:secrets_management:openbao:recovery_key:store"

2. Generate a root token. Confirm with y. The task uses the stored key, so it does not ask for one

   gitlab-rake "gitlab:secrets_management:openbao:root_token:generate"

3. In the OpenBao pod, check the token and revoke it

   BAO_ADDR=http://127.0.0.1:8200 BAO_TOKEN=<root_token> bao token lookup
   BAO_ADDR=http://127.0.0.1:8200 BAO_TOKEN=<root_token> bao token revoke -self

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.