database/postgres: add inline certificate authentication fields

[fairclothjm]

This PR adds support for inline TLS configuration.

We add new fields to the plugin's config endpoint: tls_certificate, tls_private_key and tls_ca. These fields will take certificate data as a string. This allows Vault Operators and/or development teams to configure TLS when they do not have access to the Vault Server.

Here is an example of configuring TLS inline via the new fields on the plugin’s config endpoint:

CONN_URL="user='{{username}}' database='postgres' \
  host='localhost' port='5432' sslmode='verify-full'"

vault write database/config/postgres-db \
  plugin_name=postgresql-database-plugin \
  allowed_roles="*" \
  connection_url="$CONN_URL" \
  username=client \
  tls_certificate="@/path/to/client.crt" \
  tls_private_key="@/path/to/client.key" \
  tls_ca="@/path/to/ca.crt"

The @ in the CLI argument indicates a path to a file on disk to be read.

[github-actions]

CI Results:
All Go tests succeeded! ✅

[fairclothjm]

moved to sql.go

[github-actions]

Build Results:
All builds succeeded! ✅

[fairclothjm]

This was only exported for tests but I decided we should not export this so the test usage was removed. This code path is tested however because it is called indirectly by our tests.

[vinay-gopalan]

LGTM! Had 1 question, but non-blocking

[vinay-gopalan]

Are sslcert and sslkey always required to have a TLS config? Should it be possible for the user to only set the sslrootcert? If not, wondering if it is worth returning an error to the user saying that the TLS Cert and Private Key need to be added

This is for the case if the user sets the sslrootcert but does not set either the sslcert or sslkey, then p.TLSConfig will be nil, and we would not use any info decoded in L112-L119. Since it would be under the hood I was wondering if it would be worth surfacing that we will ignore the root cert because of missing info in the config

[fairclothjm]

Great question! I considered this briefly as I was writing this code but never came back to it.

Setting only sslrootcert is a legit use case. This is useful when you want the client to verify the server certificate. See https://www.postgresql.org/docs/16/libpq-ssl.html#LIBQ-SSL-CERTIFICATES

I will update this flow to allow for this use case. 👍