feat(vso): deploy Vault Secrets Operator; add test RBAC + amd64 image aliases

- Add base/vso/ with Helm chart (v0.9.0 from helm.releases.hashicorp.com),
  namespace, and test-rbac.yaml granting the Helm test pod's default SA
  permission to create/read/delete Secrets, ConfigMaps, and Leases so the
  bundled connectivity test passes.
- Wire ../../base/vso into overlays/local/kustomization.yaml.
- Add image aliases for lasuite/people-backend and lasuite/people-frontend
  so kustomize rewrites those pulls to our Gitea registry (amd64-only images
  that are patched and mirrored by sunbeam.py).

base/vso/test-rbac.yaml

@@ -0,0 +1,30 @@
+---
+# Grant the default SA in vault-secrets-operator the permissions the Helm
+# test pod needs. The test runs the VSO binary which initializes its Vault
+# client cache by creating/reading a K8s Secret in this namespace.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: vault-secrets-operator-test
+  namespace: vault-secrets-operator
+rules:
+  - apiGroups: [""]
+    resources: ["secrets", "configmaps"]
+    verbs: ["create", "get", "update", "delete", "list", "watch"]
+  - apiGroups: ["coordination.k8s.io"]
+    resources: ["leases"]
+    verbs: ["create", "get", "update", "delete", "list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: vault-secrets-operator-test
+  namespace: vault-secrets-operator
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: vault-secrets-operator-test
+subjects:
+  - kind: ServiceAccount
+    name: default
+    namespace: vault-secrets-operator