gCloud KMS secrets backend

[adrianchifor]

Adds support for Google Cloud KMS secrets backend. To use it, we need to first create a keyring and key on KMS, then configure it in a target or class in the inventory:

parameters:
  kapitan:
    secrets:
      gkms:
        key: 'projects/<project>/locations/<location>/keyRings/<keyRing>/cryptoKeys/<key>'

and then use it, like in our example:

...
  mysql:
    password: ?{gkms:mysql/password|randomstr|base64}

which on compile, will generate a random b64-encoded string encrypted with the key at parameters.kapitan.secrets.gkms.key and save it in secrets/mysql/password.

By default, it will use gcloud default credentials, but can be configured to use a service account by setting the GOOGLE_APPLICATION_CREDENTIALS environment variable.