feat: Demonstrate alternative vault integration patterns

[butler54]

Today we use:

1. Vault -> ESO -> trustee -> KBS resource query from pod

This works well for the pattern but is not flexible e.g. platform conf yes. Application conf a user might want to pull form vault directly.

Alternatives include

1. Vault -> trustee via vault backed -> KBS resource query from pod
2. Vault -> Vault token -> Trustee serves vault token -> Pod gets vault token from KBS -> pod directly queries vault

2 is flexible including serving multiple tokens.

3. Final alternative would be to introduce spire similar to: https://github.com/validatedpatterns/layered-zero-trust. Assume we don't want to do this until we have a 'neat' integration.