A module may hold several secrets from one provider, each a pair of its own

secrets: maps a requirement to several files under local names. Each local name is
its own need, its own pair credential (the pair is keyed on it: migration 0027),
its own file on the consumer, its own holder at the provider (the identity with the
local name after it) and rotates apart from the others. The plain shape is
unchanged and every existing row is the credential it was (novox/hq 04-ISSUES/069,
ADR 0094).

internal/inventory/migrations/0027-a-module-may-hold-several-secrets-from-one-provider.sql

@@ -0,0 +1,12 @@
+-- A module may need several values from one provider that gives one per pair
+-- (novox/hq 04-ISSUES/069, ADR 0094).
+--
+-- A pair credential was keyed on (provision, consumer node, consumer module, provider): one value
+-- per module per provider. Seven catalogue modules hold two to four independent secrets of their
+-- own -- a root certificate, its key and that key's password -- and the vault could serve each
+-- module one. The pair now carries the LOCAL name the credential goes by inside the module; empty
+-- for the ordinary one, so every existing row is the credential it was.
+
+alter table secret add column local text not null default '';
+alter table secret drop constraint secret_pkey;
+alter table secret add primary key (name, local, consumer, consumer_module, provider);