Revise RPC credentials handling

[a-palchikov]

Current Result

There are two types of RPC credentials:

• installs/expands/leaves - stored in the system repository with a fixed age of 10yrs/20yrs (CA)
• upgrades - stored in the cluster-specific package repository with a fixed age of 1yrs/5yrs (CA) but with rotation with each operation

Expected Result

• Unify both types of credentials - i.e. use either one consistently
• Extend the cluster controller with the ability to verify and automatically rotate RPC credentials

Design doc: https://docs.google.com/document/d/1KVWEnLVXoExWHrq_Hm4gAJcU1ECiuQrj7k0F6rIzRJ0/edit#

[r0mant]

@a-palchikov Looks like with these changes (#1629) the rollback of /init phase screws up rpc creds package completely:

ubuntu@node-1:~/upgrade$ sudo ./gravity plan execute --phase=/init
Wed Jun  3 21:10:13 UTC	Executing "/init/node-1" locally
Wed Jun  3 21:10:15 UTC	Executing phase "/init" finished in 2 seconds
ubuntu@node-1:~/upgrade$
ubuntu@node-1:~/upgrade$
ubuntu@node-1:~/upgrade$ sudo ./gravity plan rollback --phase=/init
Wed Jun  3 21:10:19 UTC	Rolling back "/init/node-1" locally
Wed Jun  3 21:10:20 UTC	Rolling back phase "/init" finished in 1 second
ubuntu@node-1:~/upgrade$
ubuntu@node-1:~/upgrade$
ubuntu@node-1:~/upgrade$ sudo ./gravity plan execute --phase=/init
Wed Jun  3 21:10:25 UTC	Executing "/init/node-1" locally
Wed Jun  3 21:10:25 UTC	Executing phase "/init" finished in now
[ERROR]: failed to update RPC credentials
	failed to read package gravitational.io/rpcagent-secrets:0.0.1
		object not found

[r0mant]

Done in 5.5, forward-ports are tracked in #1740.