feat(image): bundle hiera-eyaml in the openvox-server image

[slauger]

Problem

hiera-eyaml does not work in the openvox-server image. On VMs the gem comes from the openvox-agent AIO package: puppet-runtime vendors rubygem-hiera-eyaml into /opt/puppetlabs/puppet/lib/ruby/vendor_gems (configs/projects/agent-runtime-8.x.rb), which is the third entry on puppetserver's gem-path. Our image deliberately drops the agent Ruby, so that directory does not exist - the rendered gem-path still lists it, but it points at nothing.

The eyaml_lookup_key function itself ships with openvox (puppet core); only the gem is missing at lookup time.

Related: #476 covered the mount-point side (hiera data / eyaml keys outside environments/), not the gem.

Fix

Install the gem into JRuby in the build stage, next to the existing openvox install:

&& puppetserver gem install --no-document hiera-eyaml -v "${RUBYGEM_HIERA_EYAML}"

• Pin the version in images/openvox-versions.yaml and wire it up for Renovate (upstream container-openvoxserver does exactly this, currently 5.0.1)
• highline and optimist come along as gem dependencies

Docs / validation

• Document the full eyaml setup: gem (now bundled), keypair mounted as a Secret via extraVolumes/extraVolumeMounts, hiera.yaml in the code image pointing at the key paths
• e2e smoke test: catalog with an eyaml-encrypted lookup compiles