vault: add support for AppRole authentication

Raised for barbican here:

  https://storyboard.openstack.org/#!/story/2004017

Review:

 https://review.openstack.org/#/c/609332

Test packages with patches in:

  https://launchpad.net/~james-page/+archive/ubuntu/vault-production

I've verified these within a Rocky deployment; secrets where stored correctly in the configured backend (charm-barbican) rather than the default 'secret' backend.

(also using an approle role_id and secret_id)

FFe details
===========

1) builds:

See PPA - https://launchpad.net/~james-page/+archive/ubuntu/vault-production

2) installs and upgrades:

Existing packages deployed and then upgraded to PPA built packages OK

3) does not break packages which depend on it, or that corresponding updates have been prepared.

Barbican and castellan covered under same bug, changes implemented in a backwards compatible way (they don't change the existing function).

4) Verification

Barbican configured with approle based authentication and a non-default KV mountpoint using proposed packages, secrets correct stored and retrieved using Vault via the Barbican API.

This bug was fixed in the package python-castellan - 0.19.0-0ubuntu2

---------------
python-castellan (0.19.0-0ubuntu2) cosmic; urgency=medium

  * d/p/0001-Fix-Vault-K-V-API-compatibility.patchi,
        0002-Add-method-to-wrap-HashiCorp-Vault-HTTP-API-calls.patch:
    Resolve issues with compatibility with Vault 0.10.0 where the KV engine
    is versioned by default (LP: #1788375).
  * d/p/0003-vault-add-AppRole-support.patch: Add support for Vault
    AppRole authentication (LP: #1796851).
  * d/p/0004-vault-support-configuration-of-KV-mountpoint.patch: Add support
    for configuration of the KV mountpoint to use in Vault (LP: #1797148).

 -- James Page <email address hidden> Thu, 11 Oct 2018 12:21:17 +0100

This bug was fixed in the package barbican - 1:7.0.0-0ubuntu2

---------------
barbican (1:7.0.0-0ubuntu2) cosmic; urgency=medium

  * d/p/0001-Enable-AppRole-authentication-support-for-Vault.patch:
    Add support for Vault AppRole authentication (LP: #1796851).
  * d/p/0002-Enable-KV-mountpoint-configuration-for-Vault.patch:
    Add support for configuration of the KV mountpoint to use in Vault
    (LP: #1797148).
  * d/control: Bump minimum python{3}-castellan version to 0.19.0-0ubuntu2~
    to pickup associated Vault fixes in lower layers.

 -- James Page <email address hidden> Thu, 11 Oct 2018 12:21:54 +0100

Reviewed: https://review.openstack.org/609332
Committed: https://git.openstack.org/cgit/openstack/castellan/commit/?id=bc7f7a4c361791727e23dab82a8abe7351483ef8
Submitter: Zuul
Branch: master

commit bc7f7a4c361791727e23dab82a8abe7351483ef8
Author: James Page <email address hidden>
Date: Wed Oct 10 10:07:11 2018 +0100

    vault: add AppRole support

    Add support for use of AppRole's for authentication to Vault; this
    feature provides a more application centric approach to managing
    long term access to Vault.

    The functional tests exercise this integration with a restricted
    policy which only allows access to the default 'secret' backend.

    Change-Id: I59dfe31adb72712c53d49f66d9ac894e43e8bbad
    Closes-Bug: 1796851

This issue was fixed in the openstack/castellan 1.2.0 release.