feat: add policy subcommand to render a vault policy without an approle backend

[fin09pcap]

Notes for your reviewers

• Introduce the sudo permissions as a potential option when defining an operation for a path.
• Add the policy subcommand to the harp-terraformer command to support the generation of a policy without an approle.

[Copilot]

Pull Request Overview

This PR introduces a new policy subcommand to generate Vault policies without using an AppRole backend, and adds support for a sudo capability in policy rules.

• Add sudo to the list of allowed Vault capabilities.
• Define a new PolicyTemplate to render policies via Terraform.
• Register and implement the policy subcommand in the CLI.

Reviewed Changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
pkg/terraformer/templates.go	Updated template comments; added PolicyTemplate.
pkg/terraformer/compiler.go	Added "sudo" to allowedCapabilities.
cmd/harp-terraformer/internal/cmd/root.go	Registered terraformerPolicyCmd in the root command.
cmd/harp-terraformer/internal/cmd/policy.go	Implemented the policy subcommand logic.

Comments suppressed due to low confidence (1)

terraformer/pkg/terraformer/templates.go:22

• The comment reads TF +0.12 which is misleading—consider reverting to TF 0.12 or clarifying if you mean >=0.12.

// ServiceTemplate is the TF +0.12 Service template.