add OpenBao as key provider for state encryption

[ollevche]

Description

This PR adds a new key provider implementation backed by OpenBao (part of #1174).

The implementation is based on Transit Secret Engine: GenerateDataKey and Decrypt API endpoints.

Documentation will be added as another PR. Here is how user-facing key_provider block looks like:

key_provider "openbao" "my_bao" {
    # Required
    key_name = "test-key"

    # Optional, could be set as BAO_TOKEN env variable
    token = "s.dummytoken"
    
    # Optional, could be set as BAO_ADDR env variable
    address = "http://127.0.0.1:8200"
    
    # Optional, allows different Transit Engine mount paths
    transit_engine_path = "/my-org/transit"

    # Optional, default value is 32 bytes
    key_length = 16
}

I tested it manually and ran compliance tests against OpenBao, Vault, and internal mock.

Update

• data_key_bit_size (bits) changed to key_length (bytes)
• add transit_engine_path field

Target Release

1.7.0

[github-actions]

Reminder for the PR assignee: If this is a user-visible change, please update the changelog as part of the PR.

resolved

[siddharthasonker95]

LGTM

[cube2222]

Nice one!

I'd like for Janos to have a final look at this before merging, please.

[janosdebugs]

Great work, just lots of tiny nit-picks! Thanks for this!

[janosdebugs]

Thank you for all the fixes!

[ollevche]

Note: we need to update the links in docs once the OpenBao website is up and running.

Created an issue in OpenBao: openbao/openbao#262

[cipherboy]

I don't think my comments about key and paths are worth holding up this PR over, looks good @ollevche! Looking forward to this feature and thanks for the collaboration :-D