Add secret store unseal playbook for action runners

[seunghun1ee]

When CI action runners are rebooted, their secret store needs to be unsealed.
Added unsealing playbook for them.

[gemini-code-assist]

Code Review

This pull request introduces a new Ansible playbook for unsealing the secret store on CI action runners, which is a necessary step after they are rebooted. The playbook is clear and follows existing patterns within the project. My review includes a couple of suggestions to improve maintainability and idempotency. One suggestion is to change the pip package state from latest to present to ensure predictable behavior. The other is a recommendation to refactor common tasks into a shared role to avoid code duplication with other similar playbooks.

[Alex-Welsh]

Needs a reno

Given how similar this and the other secret-store-unseal-*.yml playbooks are, we should probably just extend the vault_unseal role to reduce duplication a bit.

That's scope creep though, and I'm happy to do it this way for now.

[Alex-Welsh]

One more general thought, should we just run this every time we trigger CI?

[seunghun1ee]

I don't know... Maybe?

[seunghun1ee]

Well even if we want to run this every time we run CI, I think that needs to be done via separate PR.