Move ocp-relay CD from Silver to Gold OpenShift cluster

[panish16]

Summary

• Switches ocp-relay-cd.yml to the shared bcgov/bcregistry-sre backend-cd-ocp.yaml reusable workflow, using OPENSHIFT_GOLD_* secrets instead of the Silver-cluster OPENSHIFT4_* secrets. This matches the pattern already used for other BC Registries OCP services (bcgov/sbc-pay ftp-poller, bcgov/namex-search namex-solr-importer, bcgov/lear colin-api).
• Adds services/ocp-relay/devops/vaults.ocp.env, required by the reusable workflow's 1Password injection step.

Gold cluster bootstrap (done, outside this PR)

The reusable CD workflow only updates an existing Secret and restarts an existing Deployment — it doesn't create them. So ahead of the first CD run, the following were provisioned directly in cbaab0-dev (namespace confirmed by SRE):

• ocp-relay-dev-secret — merged with the partial secret SRE had already seeded (Colin/Pay/JWT values were already correct and Gold-specific; only the still-placeholder SFTP/BCREG_FTP_* keys were filled in, copied from the working Silver values)
• ocp-relay-dev Deployment (currently ImagePullBackOff as expected — no image has been pushed to cbaab0-tools yet, that's the CD workflow's job on first run)
• ocp-relay-dev Service + Route (ocp-relay-dev.apps.gold.devops.gov.bc.ca)
• vaults.ocp.env key names verified 1:1 against the real Silver secret's 21 keys

Needs confirmation before merge (still draft)

• The vaults.ocp.env vault/item paths (op://...) are still placeholders drafted by naming-convention analogy — not verified against the actual 1Password structure. Keys are correct, paths need SRE sign-off.
• OPENSHIFT_GOLD_DOCKER_REGISTRY, OPENSHIFT_GOLD_LOGIN_REGISTRY, OPENSHIFT_GOLD_SA_NAME, OPENSHIFT_GOLD_SA_TOKEN, OPENSHIFT_GOLD_REPOSITORY need to be added as repo/environment secrets on bcgov/namex — requires repo admin access, which this PR's author doesn't have. Values:
  • OPENSHIFT_GOLD_DOCKER_REGISTRY = image-registry.apps.gold.devops.gov.bc.ca
  • OPENSHIFT_GOLD_LOGIN_REGISTRY = https://api.gold.devops.gov.bc.ca:6443
  • OPENSHIFT_GOLD_REPOSITORY = cbaab0
  • OPENSHIFT_GOLD_SA_NAME = github-cicd
  • OPENSHIFT_GOLD_SA_TOKEN = value of the github-cicd-token-c6l84 service account token secret in cbaab0-tools
• Confirm OP_SERVICE_ACCOUNT_TOKEN is already available to this repo (used by sibling CD workflows; not verified here due to permissions)

Refs bcgov/entity#34060

Test plan

• SRE confirms/corrects the 1Password vault/item paths in vaults.ocp.env
• Repo admin adds the OPENSHIFT_GOLD_* secrets above
• Run workflow_dispatch against dev and verify rollout succeeds in Gold

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE