Store Gitea data (avatars, attachments, etc.) in Garage/S3

Also adds a new garage gateway role, which only allows RPC (inter-node)
traffic to Garage.

data_bags/credentials/gitea.json

@@ -1,30 +1,51 @@
 {
   "id": "gitea",
   "jwt_secret": {
-    "encrypted_data": "jTNhXpJ1mhUXjfRZ3OAR8lrGgxyyob44kN0TyNec5zO2Wb46hJgYMWwtKlZ9\nohNexOKV+wXCjZNeVw0kNgI=\n",
-    "iv": "NYkJTeTzLilMLptE\n",
-    "auth_tag": "a/PuBmOmhyCx0ooepz7n1w==\n",
+    "encrypted_data": "suy7Vwlg7tyJFBSjlnNRv7qR4jp1o9F0TbwxGcwWqbCpQW2NHl9QS1SCXJml\n4UbKklppjp+7Axvvs7YiOX8=\n",
+    "iv": "ojZAtLDxV6569XHN\n",
+    "auth_tag": "j15eLXjGMIIsXh5dHET/lw==\n",
     "version": 3,
     "cipher": "aes-256-gcm"
   },
   "internal_token": {
-    "encrypted_data": "HbyEfyrupc06vGHhSqKUUT8NAIrlvbK4LbMdqxmJMgeltvDItqGgFa0ZdD51\n0djRqQMrRZ4MEdqVTFSBL+8QVdriKeUcLcummp52Sp9tYZKSQKympJFx3fsS\n49rBJhDKRlc3+jUpejJu4jHY4xR2MMNvWWqkkufTvZHhzg==\n",
-    "iv": "DUSCP7Q3dgjyYXwl\n",
-    "auth_tag": "HkPLLvY8uVNK871OsMshcg==\n",
+    "encrypted_data": "y7VG9w8Gz/jxgz86p/OtpVvJBYjD6yGOPhCM3SEPlbQF/gqI8VuTkJlUQLFB\nrsPiCcjjynuTPJPLvdkVUu1XjOfp5dtbPDc0hqp8KhvBx4DhnH7Mspp/kWfb\n9DWzJ6zeGBB/nrNay0jTV1MoqzKc3Nl0GSkzBLMbr15vVw==\n",
+    "iv": "wcx+w1Ij5Dee/81s\n",
+    "auth_tag": "C7QMXezMU+jcYZAjlm86rg==\n",
     "version": 3,
     "cipher": "aes-256-gcm"
   },
   "secret_key": {
-    "encrypted_data": "bvxdPokzagjZkdGG37hbWBi6ywu+1UuOrlJJ4p5zOG03b4PN4N40ztO4fWr5\ncMHfO7FER779fRc+tA2H7L1SKqSvlJThgk7X8R7AGGQmrQy7Jvc=\n",
-    "iv": "0uTGeUjnbvnW2WGp\n",
-    "auth_tag": "Dzfb3Jiim5eYWfwpN3HO5Q==\n",
+    "encrypted_data": "4DGRaIbqqa5oCzFwNUjRPcP+uauWidjWwmBZY0BNyI3c/XmQBEb8wGV9Leoc\n3avqM5jhS/Ov43SBMpCrR71x4eAPJ3vlSeQ3GnpkgFyWfolmbEg=\n",
+    "iv": "SOTJFH8JkBNtPKyF\n",
+    "auth_tag": "fYSfkMMvGnPdiBOP7NnP8Q==\n",
     "version": 3,
     "cipher": "aes-256-gcm"
   },
   "postgresql_password": {
-    "encrypted_data": "yv2gQYUxMTa7eeC0GJqE+fujOvM9GIwj/OL/L1wvn7uNTjJE97Xt1gYXRw==\n",
-    "iv": "F6yrDSav9EShCf2N\n",
-    "auth_tag": "08b4vT71g41qu6A6jZ6opw==\n",
+    "encrypted_data": "tA/mMteX2aO7dozNe/YWB8S9sVDdUgzKDnAdgnsXF5qTVT0slHe3KRg7og==\n",
+    "iv": "3/rdo8uCdhrFOWOf\n",
+    "auth_tag": "uNl4R3T5ylEBgAM8P6fdYA==\n",
+    "version": 3,
+    "cipher": "aes-256-gcm"
+  },
+  "s3_key_id": {
+    "encrypted_data": "Pjaw1MM+GNZN68XDbM+PGJUwSSXwu1+ASgm4S0VZ3MvylVG3uBPdqdDUZ9g8\n",
+    "iv": "mPL4HvodGKMD+30N\n",
+    "auth_tag": "nrej5vDLEzAI9HkKJxa/mQ==\n",
+    "version": 3,
+    "cipher": "aes-256-gcm"
+  },
+  "s3_secret_key": {
+    "encrypted_data": "yBWAUGyyoetZ8EDD+kVffGDQbFPVXxpiWCdWL5xn3ohlclrrcWBQP/cGj2Ts\nlSZ2l4ZIuHX6ZdAHe5O2C1h5nYVtWx+u5kVa9n6EoUbz/6iseHU=\n",
+    "iv": "jmIdQZVMCLLKs1pi\n",
+    "auth_tag": "0Jvgjuvhv11/QNV43zm1LQ==\n",
+    "version": 3,
+    "cipher": "aes-256-gcm"
+  },
+  "s3_bucket": {
+    "encrypted_data": "MyR5WhJMGfu+StFPVt3wSzVSNsHnEiLfzKXm2xJeb/cEQVw=\n",
+    "iv": "CHmMCjdVzw+qKHIV\n",
+    "auth_tag": "tiQegK0hQfCjcgRxg1G8Rg==\n",
     "version": 3,
     "cipher": "aes-256-gcm"
   }