Create a vault share

Grant another organization read-only access to this vault. Only the vault owner can create shares. Idempotent: re-sharing to the same org updates the existing share.