Fix afs publishing of translation sources

There are at least two problems here. The first is we can't create an
afs token because we don't have access to the afs secret. The old ssh
based secret was removed by:

  https://review.opendev.org/#/c/706734/2/zuul.d/jobs.yaml

Fix that by adding the new opendev tarballs secret to the job.

Next we need to prefix translation sources with translation-source/ in
the filesystem path. This requires us to write out to a different afs
path than normal. To address that we add a new playbook that is aware of
this different path.

Change-Id: I8b49e4d91600377c98e003b806a13fc89d2614ec

playbooks/translation/openstack-translation-artifacts.yaml

@@ -0,0 +1,16 @@
+- hosts: localhost
+  tasks:
+    - block:
+        - name: Create AFS token
+          include_role:
+            name: create-afs-token
+        - name: Upload to afs
+          include_role:
+            name: upload-afs-synchronize
+          vars:
+            afs_source: "{{ zuul.executor.work_root }}/artifacts/"
+            afs_target: "/afs/.openstack.org/project/tarballs.opendev.org/translation-source/{{ zuul.project.short_name}}/"
+        - name: Destroy AFS token
+          include_role:
+            name: destroy-afs-token
+      when: zuul_success | bool

zuul.d/jobs.yaml

@@ -1049,11 +1049,10 @@
     run: playbooks/translation/upstream-translation-update.yaml
     post-run:
       - playbooks/translation/post.yaml
-      - playbooks/publish/openstack-artifacts.yaml
+      - playbooks/translation/openstack-translation-artifacts.yaml
     semaphore: translations
     protected: true
     vars:
-      fileserver_leading_path: translation-source
       constraints_file: '{{ ansible_user_dir }}/src/opendev.org/openstack/requirements/upper-constraints.txt'
     required-projects:
       - openstack/horizon
@@ -1063,6 +1062,8 @@
     nodeset: ubuntu-bionic
     secrets:
       - zanata_api_credentials
+      - secret: afs_tarballs_opendev_org
+        name: afs
 
 - job:
     name: propose-translation-update