Vault (vault, vault+http, vault+https) support

[hairyhenderson]

No description provided.

[hairyhenderson]

Some notes while I work on implementing this:

• It looks like Vault Agent can listen on a Unix domain socket, and also that the Vault Agent can now act as a proxy - thus, it seems like it might make sense to support vault+unix as a scheme. However, to start I think it makes the most sense to require setting VAULT_AGENT_ADDR to get that behaviour and just use host-less vault:/// URLs.
• Quite a lot of functionality in Vault is achieved with query parameters
  • I think they should work OK if specified as filenames (I'll have to parse them out obviously)
  • Right now in gomplate if any query params are present the operation is assumed to be a Write (PUT) rather than a Read (GET)
    • This works for some dynamic secret backends like SSH or PKI that have write-then-read semantics
    • It won't work for other backends that support reads with parameters (like KV-v2 with the ?version param, or AWS with aws/sts/:name?role_arn=...)
    • The only option may be to detect the specific backends that I know support params on GET endpoints - for KV-v2 I may need to do some auto-detection anyway (see https://github.com/hashicorp/consul-template/blob/43d2820fe831696f629c91169b4cf3d832f42425/dependency/vault_common.go#L282)