feat(inventory): B2: serve an environment's inventory from canopy

[dannash100]

Ansible reads each environment's servers and variables from a file nothing keeps in step with canopy, and that file holds the salts and enrolment tokens in the clear.

• POST /api/inventory/for_group, by group name or id plus a rank: live servers with product, kind, rank, address, vars.
• Vars are the server's tags over its group's; true/false and JSON arrays decode, everything else stays text.
• Secret vars go to the secret store rather than to tags, scoped to an environment or one server. A name is a tag or a secret, never both, refused either way round.
• Admin-only now, and refused outright when a value can't be read rather than served a member short of one.
• The response marks which vars are secret, so the ansible cache can drop them (beyondessential/ops#290).

Spec: .workhorse/specs/private-server/inventory.md. It links GRP, so #524 wants to land first. The ansible side is beyondessential/ops#290.

QA

Inventory from canopy

[passcod]

well, that's a problem, because there's secrets in the variables. so can't use that design

[dannash100]

Oh true that my bad