Add warnings to crl rebuilds, allowing notifying operator of empty issuer equivalency sets

[cipherboy]

When a user generates an external CA without KeyUsage bits and imports it into Vault (as Vault does not allow setting KeyUsage on internally generated CAs), they can end up with issuer equivalency classes without a valid representative for generating the CRL. This is because Go fails on rebuilding CRLs for issuers lacking an asserted CRL Building KeyUsage.

Add warnings into the CRL rebuild infrastructure and allow certain actions to directly expose them to operators (import, manual rebuild, potentially revoke), whereas all other operations will result in these warnings being logged at a Warn level.

I'm not quite happy with this approach: over a cluster's lifetime, I'd imagine this could get somewhat verbose if the operator does not take steps to address it. However, it is also a somewhat rare problem to have (though, I have added one other warning when a legacy bundle is in use with delta CRLs), so I'm inclined to believe that while it is not perfect, it is perhaps good enough.

---

During import this looks like:

[cipherboy@xps15 vault]$ vault write pki/issuers/import/bundle pem_bundle=@/home/cipherboy/GitHub/cipherboy/testbed/chain-building/experiments/ca/root-old/certs/ca.pem
WARNING! The following warnings were returned from Vault:

  * Warning 1 during CRL rebuild: warning from local CRL rebuild:
  Issuer equivalency set with associated keys lacked an issuer with CRL
  Signing KeyUsage; refusing to rebuild CRL for this group of issuers:
  3794ea87-4275-5c89-aee8-a69737847362

  * This mount hasn't configured any authority information access (AIA)
  fields; this may make it harder for systems to find missing certificates
  in the chain or to validate revocation status of certificates. Consider
  updating /config/urls or the newly generated issuer with this information.

Key                 Value
---                 -----
imported_issuers    [3794ea87-4275-5c89-aee8-a69737847362]
imported_keys       <nil>
mapping             map[3794ea87-4275-5c89-aee8-a69737847362:b3cd91f3-e1f1-39a0-e297-504104bb9069]
[cipherboy@xps15 vault]$ 

This also appears on the CRL rebuild endpoint (/pki/crl/rotate).

---

Resolves: #20137