add provider ca support for approle auth-method

[eikenb]

Adds support for the approle auth-method. Only handles using the approle role/secret to auth and it doesn't support the agent's extra management configuration options (wrap and delete after read) as they are not required as part of the auth (ie. they are vault agent things).

PR Checklist

• updated test coverage
• external facing docs updated (update connect/ca's vault AuthMethod conf section #16346)
• not a security concern

[eikenb]

Note that there is a failing test that doesn't test what it seems like it should and makes me unsure about the fields that are required as part of this.

Our docs say the role_id_file_path is a require parameter but we have a test that has the role_id and secret_id set directly in the params.

I'm going to look at this more tomorrow, but wanted to drop a note in case a reviewer drops by.

[eikenb]

Figured out what is going on with that test. Here is the comment I wrote (on the K8s support PR, #16262) to explain what is going on in regard to this...

// Note the authMethod's parameters (Params) is populated from a free form map
// in the configuration where they could hardcode values to be passed directly
// to the auth/*/login endpoint. So each auth method's authentication code
// needs to handle both these cases. The legacy case (which should be
// deprecated) where the user has hardcoded login values directly (eg. a jwt
// string) and the case where they use the configuration option used in the
// vault agent's auth methods.

[cthain]

👍