Consul acl role support

[robmonte]

This is a refresh of the PR submitted by @BrandonIngalls here: #11025 which adds support for Consul ACL roles. This simplifies management of Vault tokens that use multiple Consul policies. Previously, you needed to replicate the work of assigning multiple Consul policies to a role in both Vault and Consul.

For example, let's say you work on assigning 20 different ACL policies into a single Consul role named "admin-access". With current Vault, you'd need to assign all 20 polices again to a Vault role like this:

❯ vault write consul/roles/my-role policies="policy1,policy2,policy3,...,policy20"

With Consul role support, it changes to this:

❯ vault write consul/roles/my-role roles="admin-access"

Additionally, if you want to assign multiple Consul roles to a Vault role, you can:

❯ vault write consul/roles/my-role roles="admin-access,role2,role3,...,etc"

 

The original author's commits are retained to preserve credit for the work generously provided, save for merge conflicts, and the CLA was previously signed here: #11025 (comment)

Closes #10752, #11025

[austingebauer]

One comment, otherwise LGTM along with Calvin's suggestions. Great level of detail with the description and documentation 👍

[calvn]

Looks great!

[austingebauer]

LGTM 👍