CredentialsManager should be able to persist credentials to disk

[andrewazores]

https://github.com/cryostatio/cryostat/blob/74328d3268156f001b8977ab769601da7a3e2fd5/src/main/java/io/cryostat/configuration/CredentialsManager.java#L93

[andrewazores]

@ebaron what's your take on this? These are the stored credentials used to allow Cryostat to connect to targets that have JMX credentials enabled. Currently those are only kept in-memory and never persisted to disk. I did this because it should be much safer than writing the credentials out to disk in plaintext, since the storage medium (ex. OpenShift PVC) could be mounted to some other container and read by some other process at some point in time. We do need to somehow store the entire credential and not just its hash, so the only other solution would seem to be to encrypt/decrypt when storing/retrieving from disk. I'm not sure what we would use as an encryption key, or seed to generate one, that can persist between Cryostat container restarts and also remain private/a secret, however. Perhaps we would require the user to set this via an environment variable and let them figure out how to manage their secrets.

[andrewazores]

@jan-law interested in taking this one? I think it's pretty straightforward now that we've decided that POSIX file permissions are secure enough for our intended deployment scenarios. I suppose this doesn't even need to be configurable anymore - it can just always persist to disk.

Also, link back to related discussion at cryostatio/cryostat-web#257