add flag to allow /operator/keyring requests to only hit local servers

[s-mang]

Add parameter local-only to operator keyring list requests to force queries to only hit local servers (no WAN traffic).

HTTP API: GET /operator/keyring?local-only=true
CLI: consul keyring -list --local-only

Sending the local-only flag with any non-GET/list request will result in an error.

[mkeeler]

This looks really good. I have a few requests regarding code style, test framework usage and some error handling but nothing major.

[hanshasselberg]

I was wondering if we want to provide the same functionality on the cli command consul keyring -list as well.

[s-mang]

@i0rek

I was wondering if we want to provide the same functionality on the cli command consul keyring -list as well.

I'll leave this to @mkeeler to answer! Happy to add it in.

[mkeeler]

@i0rek brings up a good point. This PR should include changes for both the API module in api/operator_keyring.go and for the CLI command in command/keyring/keyring.go

[s-mang]

@mkeeler @i0rek this is ready for another review
re: using BadRequestError types: I just changed all of the instances in the file (most of them in the same handler) now, instead of waiting for the follow-on PR
re: testing using require pkg: I've got one new test in there using require, and I will submit a follow-on PR with only fixes to touched tests to use require.

[mkeeler]

LGTM