Add Tink signing backend for local signing

[haydentherapper]

Description

A Tink keyset will be encrypted with a remote KMS key, and on CA startup, the keyset will be decrypted and loaded into memory. Keys can be created and encrypted using https://github.com/google/tink/blob/master/docs/TINKEY.md.

There are two main benefits from this work: We can leverage this instead of KMSCA if we need to support a higher QPS, and Tink keysets use strong secure defaults. Keysets can be encrypted with AESGCM, do not rely on a KDF, cannot be brute-forced, and access to the key can be audited through cloud audit logs.