go/registry: Avoid storing full TLS certificates

[kostko]

Fixes #2556

Previously the node registry descriptor contained full TLS certificates for
talking with nodes via gRPC. This changes it so that only TLS public keys are
used when verifying peer certificates for TLS authentication.

This makes the registry descriptors smaller and also makes it easier to pass
around TLS identities (as public keys are much shorter).

Obviously, this change BREAKS the consensus protocol and all previously
signed node descriptors.

The following configuration changes are needed due to this change:

• In oasis-node registry node CLI, the --node.committee_address option
  has been renamed to --node.tls_address and the format has changed from
  <certificate>@ip:port to <pubkey>@ip:port.

• For configuring sentry nodes on the workers, the
  --worker.sentry.cert_file has been removed. Instead, the
  --worker.sentry.address now takes the same address format as specified
  above (<pubkey>@ip:port).

Previously signed node descriptors (v0) are considered valid at genesis time
iff the node is exclusively a validator node as indicated by the role bits.
Other nodes will need to be removed from genesis.

TODO

• Blocked by Version signed (entity/node/runtime) descriptors #2581.
• Limited support for old node descriptors at genesis.
• Tests with old node descriptors at genesis.
• Document what configuration changes are required.

[codecov]

Codecov Report

Merging #2914 into master will increase coverage by 0.57%.
The diff coverage is 68.23%.

@@            Coverage Diff             @@
##           master    #2914      +/-   ##
==========================================
+ Coverage   67.81%   68.38%   +0.57%     
==========================================
  Files         358      360       +2     
  Lines       34909    34937      +28     
==========================================
+ Hits        23673    23893     +220     
+ Misses       8175     7965     -210     
- Partials     3061     3079      +18     

Impacted Files	Coverage Δ
go/consensus/tendermint/apps/scheduler/query.go	69.44% <0.00%> (ø)
go/worker/common/configparser/configparser.go	60.00% <ø> (-0.98%)	⬇️
go/common/crypto/tls/verify.go	32.69% <32.69%> (ø)
go/registry/api/legacy_v0.go	37.83% <37.83%> (ø)
.../consensus/tendermint/apps/registry/state/state.go	58.87% <40.00%> (-0.67%)	⬇️
go/sentry/api/grpc.go	54.16% <41.66%> (ø)
go/common/entity/entity.go	68.23% <45.45%> (+5.73%)	⬆️
go/common/node/address.go	71.96% <50.00%> (-2.35%)	⬇️
go/common/accessctl/accessctl.go	84.61% <55.55%> (-15.39%)	⬇️
go/registry/api/api.go	39.42% <63.82%> (+1.09%)	⬆️
... and 62 more

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 2341d2b...476b7ec. Read the comment docs.