Support SPIFFE authentication for M2M scenario

Summary This is a proposal to add support for SPIFFE (Secure Production Identity Framework for Everyone) as an authentication method in Vaultwarden, allowing Kubernetes workloads to authenticate using their cryptographic workload identity instead of static username/password credentials. Motivation When running Vaultwarden, operators and automation tooling (such as External Secrets Operator) authenticate to Vaultwarden using long-lived, static credentials stored as Kubernetes Secrets. This creates a bootstrapping problem: to securely retrieve secrets from Vaultwarden, you first need to securely store Vaultwarden credentials somewhere. SPIFFE solves this by giving each workload a short-lived, cryptographically verifiable identity (an SVID) issued by a trusted SPIRE server. No pre-shared secrets are needed — the workload proves who it is by presenting its SVID, and the server validates it against the trust bundle. Prior Art This pattern is well-established in adjacent p…