Integrate Istio Citadel agent and Vault

[myidpt]

Describe the feature request
Enable the Citadel agent to call the Vault server to provision X.509 certificates. The authentication and authorization (based on K8s JWT) are conducted on Vault (assume the customer maintains a syncer from K8s service account to Vault roles).

Describe alternatives you've considered
Delegate the authn and authz to Citadel, and hook up Citadel with Vault.

[myidpt]

Sub-tasks:

• Implement Vault client adaptor on Citadel agent to call to Vault
• Implement end-to-end test for K8s
• user instructions

[lei-tang]

@myidpt Thanks for creating the task! I have started working on it.

[jasminejaksic]

Only pending task is user instructions, so moving this to P1. Oliver is working on it, ETA EoM

[lei-tang]

The issue #10968 has been created to track the task of user instructions and is assigned to @lei-tang.