Add rotate-root endpoint

[jasonodonnell]

This adds a new endpoint to support rotation of the root password in Azure. I had to rearrange some of the WAL code to support the root rotation because the current WAL rollback code deletes the service principal app when there's an error.

I'm still working on updating the test cases for the new endpoints, but the core logic is ready for review.

Testing

Setting up an Azure root account for Vault can be difficult, but our learn guide does a good job of guiding an operator through it.

$ vault secrets enable azure

$ vault write azure/config \
        subscription_id=$SUBSCRIPTION_ID  \
        client_id=$CLIENT_ID \
        client_secret=$CLIENT_SECRET \
        tenant_id=$TENANT_ID \

$ vault write -f azure/rotate-root
Success! Data written to: azure/rotate-root

After rotation in Azure you can view the new secret attached to the application.

[jasonodonnell]

Unfortunately there's a bit of eventual consistency when updating these secrets.

[~] vault write -f azure/rotate-root
Success! Data written to: azure/rotate-root

[~] vault write -f azure/rotate-root
Error writing data to azure/rotate-root: Error making API request.

URL: PUT http://127.0.0.1:8200/v1/azure/rotate-root
Code: 500. Errors:

* 1 error occurred:
	* azure.BearerAuthorizer#WithAuthorization: Failed to refresh the Token for request to <REDACTED>: StatusCode=401 -- Original Error: adal: Refresh request failed. Status Code = '401'. Response body: {"error":"invalid_client","error_description":"AADSTS7000215: Invalid client secret is provided.\r\nTrace ID: <REDACTED>\r\nCorrelation ID: <REDACTED>\r\nTimestamp: 2021-08-03 14:53:22Z","error_codes":[7000215],"timestamp":"2021-08-03 14:53:22Z","trace_id":"<REDACTED>","correlation_id":"<REDACTED>","error_uri":"https://login.microsoftonline.com/error?code=7000215"} Endpoint <REDACTED>"}

[~] vault write -f azure/rotate-root
Success! Data written to: azure/rotate-root

[reegnz]

@jasonodonnell the eventual consistency issue you're experiencing is because of the deprecated Azure AD API not providing atomic create/delete password operations.

See #63 and #59 for attempts at fixing this problem by moving to the MS Graph API.

[jasonodonnell]

Thanks @reegnz, we're already looking into making the change to MS graph 😄