feat(g/infra): Add database credential backup to Vault

[hk21702]

Here, we expand on the backup-database action, adding functionality to allow for the optional backing up of database credentials to a vault, which is required for cases where the entire cluster is lost.

As the usernames needed differ not only between PostgreSQL and MySQL but also between revisions, we need to allow the user to pass in their username target.

By default, the credentials secret path is constructed as secret/services/{model}/{application}-credentials. The secret is created if it does not exist already.

To avoid making unnecessary writes and incrementing revisions every time the action is run, we first fetch the secrets from the vault. This is later used to compare against what the charm reports. Only if there is a mismatch do we attempt a write.

To avoid leaking credentials to the logs, we take advantage of GitHub's masking feature.

Vault credentials are provided via a token input.

The action will install the vault snap if it is not already installed, allowing for multiple calls to the action within the same job.

In a dry run scenario, we only skip write actions to the vault.

Depends on #134

Refs:
https://canonical.com/data/mysql/docs/8.4/how-to/back-up-and-restore/migrate-a-cluster/
https://canonical.com/data/postgresql/docs/14/how-to/back-up-and-restore/migrate-a-cluster/

---

UDENG-11019

[Copilot]

Pull request overview

This PR extends the existing gh-actions/infra/backup-database composite action to optionally back up database user credentials (via the charm get-password action) into Vault, minimizing writes by comparing against current Vault values and masking retrieved secrets in GitHub Actions logs.

Changes:

• Adds a new backup_credentials.py helper to retrieve credentials, compare against Vault, and conditionally write updates.
• Extends the composite action inputs/steps to install Vault, read existing KV values via hashicorp/vault-action, and run the new credential backup script.
• Expands test coverage and updates documentation to describe the new credential-backup behavior and inputs.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
gh-actions/infra/backup-database/action.yaml	Adds Vault install/fetch steps and a credential-backup step; updates summary rendering to include credential results.
gh-actions/infra/backup-database/backup_credentials.py	New implementation for retrieving charm credentials and writing to Vault only when values differ, with masking support.
gh-actions/infra/backup-database/README.md	Documents new credential-backup inputs and usage example.
gh-actions/infra/backup-database/tests/test_backup_database.py	Adds unit tests covering credential-target parsing, masking, dry-run behavior, and Vault write behavior.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[hk21702]

Example run:
https://github.com/canonical/ubuntu-engineering-terraform-models/actions/runs/30057647433
Dry run:
https://github.com/canonical/ubuntu-engineering-terraform-models/actions/runs/30057983732

[didrocks]

I will let Matt and Carlos reviewing throughfully that one first. Thanks for the tests in it. I think some could have been restructed and refactored in table testing format to spot more easily the difference in behaviours, but for an action, that’s not too much of a biggie.