feat(tools): implement ENABLE_VAULT_OPERATIONS to gate mutating tools

[artfaal]

Problem

The security model docs recommend setting ENABLE_VAULT_OPERATIONS=false "if write access isn't needed", but the variable is not implemented — InitTools registers every tool unconditionally, so a read-only deployment still exposes write_secret, delete_secret, create_mount, delete_mount and the PKI-write tools.

Change

Implement the documented flag. Mutating tools (write/delete/create + PKI enable/issue) register only when ENABLE_VAULT_OPERATIONS=true. Default is read-only: list_mounts, list_secrets, read_secret, plus PKI reads.

Why it matters

Operators with read-only use cases can now actually restrict the tool surface, matching what the security-model documentation already promises.

[hashicorp-cla-app]

Thank you for your submission! We require that all contributors sign our Contributor License Agreement ("CLA") before we can accept the contribution. Read and sign the agreement

Learn more about why HashiCorp requires a CLA and what the CLA includes

---

Max Solovev seems not to be a GitHub user.
You need a GitHub account to be able to sign the CLA.
If you have already a GitHub account, please add the email address used for this commit to your account.

_{Have you signed the CLA already but the status is still pending? Recheck it.}

[hashicorp-cla-app]

Thank you for your submission! We require that all contributors sign our Contributor License Agreement ("CLA") before we can accept the contribution. Read and sign the agreement

Learn more about why HashiCorp requires a CLA and what the CLA includes

---

Max Solovev seems not to be a GitHub user.
You need a GitHub account to be able to sign the CLA.
If you have already a GitHub account, please add the email address used for this commit to your account.

_{Have you signed the CLA already but the status is still pending? Recheck it.}