feat: Add PKI capability

[snocorp]

Description

Add the ability to generate PKI certificates from Vault's PKI engine. You can now use the pki option to generate a certificate and private key for a given role.

with:
    pki: |
        pki/issue/rolename {"common_name": "role.mydomain.com", "ttl": "1h"} ;
        pki/issue/otherrole {"common_name": "otherrole.mydomain.com", "ttl": "1h"} ;
```

Resulting in:

```bash
ROLENAME_CA=-----BEGIN CERTIFICATE-----...
ROLENAME_CERT=-----BEGIN CERTIFICATE-----...
ROLENAME_KEY=-----BEGIN RSA PRIVATE KEY-----...
ROLENAME_CA_CHAIN=-----BEGIN CERTIFICATE-----...
OTHERROLE_CA=-----BEGIN CERTIFICATE-----...
OTHERROLE_CERT=-----BEGIN CERTIFICATE-----...
OTHERROLE_KEY=-----BEGIN RSA PRIVATE KEY-----...
OTHERROLE_CA_CHAIN=-----BEGIN CERTIFICATE-----...

Checklist

• Added CHANGELOG entry (only for user-facing changes)

Community Note

• Please vote on this pull request by adding a 👍
  reaction
  to the original pull request comment to help the community and maintainers
  prioritize this request
• Please do not leave "+1" comments, they generate extra noise for pull request
  followers and do not help prioritize the request