Add Vercel KMS support

[marcgreenstock]

Summary

Adds Terraform support for managing Vercel KMS, which previously had no
provider coverage — issuers, their signing keys, project-grant policies, and
self-signed certificates could only be managed via the dashboard or API. This
lets users manage the full KMS lifecycle as code.

• vercel_kms_issuer (resource + data source) — JWT issuer with a JWKS
  endpoint; name is mutable, key material is immutable/computed. Supports
  importing an external private key.
• vercel_kms_issuer_policy — project-grant policies authorizing a project to
  request signed tokens in given environments, with optional token claims.
• vercel_kms_signing_key — models an imperative key rotation via a keepers
  trigger; keys retire on the next rotation (no single-key delete API).
• vercel_kms_certificate — mints an ephemeral self-signed X.509 certificate;
  generate-on-create with a keepers trigger, no server-side read/delete.

Validation

• KMS endpoints 404 when the feature flag is off, so acceptance tests are gated
  behind VERCEL_TERRAFORM_TESTING_KMS=true on a KMS-enabled team. The issuer
  test covers create → import → rename; the signing-key and certificate tests
  assert that changing keepers produces a new key id / serial number.

Made with Cursor