Enable Vault PKI secrets engine

[bnevis-i]

🚀 Feature Request

Relevant Package

Affects security-secrets-setup (#1924) and secret store configuration
This is a sub-story of https://github.com/edgexfoundry/edgex-go/issues/1950.

Description (original)

There are multiple reasons why one would want to enable the PKI secrets engine in Vault:

• Enable TLS-encrypted communications between micro-services. (Note: Consul Connect has built-in Vault integration for just this purpose)
• Simplify the installation of the Kong proxy certificate (Streamline proxy certificate upload flow #1922)
• Enable service-to-service authentication via mutual-auth TLS or JWT signatures
• Unforseen end-user use-cases for a local PKI

For these reasons it would be useful to import an intermediate CA (#1924) into Vault, enable the PKI secrets engine, and issue additional certificates at runtime as-needed to build additional TLS-dependent services. This will help minimize security-secrets-setup usage to just security services bootstrapping and nothing more.

Description (from merged ticket #2455)

In order to enable microservices to authenticate the server side of a connection and provide confidentiality and integrity protection of microservice communications, we should enable the Vault PKI secrets engine for issuing of leaf TLS certificates and add hooks to go-mod-secrets to request the private key at runtime in order to secure the services' REST API server.