refactor(openbao): migrate to vaultrs client library

Replace hand-rolled OpenBao HTTP client with vaultrs 0.8.0, which
has official OpenBao support. BaoClient remains the public API so
callers are unchanged. KV patch uses raw HTTP since vaultrs doesn't
expose it yet.

Cargo.toml

@@ -69,6 +69,9 @@ tempfile = "3"
 dirs = "5"
 chrono = { version = "0.4", features = ["serde"] }
 
+# OpenBao/Vault client
+vaultrs = "0.8"
+
 # Workflow engine
 wfe = { version = "1.6.3", registry = "sunbeam" }
 wfe-core = { version = "1.6.3", registry = "sunbeam", features = ["test-support"] }