Add client certificate authentication support to the database secrets engine

[remilapeyre]

This builds on #11985 to make it
possible to use client cert autheentication in the database secrets
engine using a CA managed by Vault. This is useful to automatically
bootstrap the ACL management of a database without having to manually
set a password for the role used by Vault, or taking the risk of the
password being saved, leaking in the logs or something going wrong if
using some sort of automation to create the database configuration.

I choosed to make it very simple for now and only add more parameters
later if some user ask for it:

• Vault generate a CA at ca when enabling the database secrets
  engine. This CA is valid for one year and uses RSA 2048. It's time to
  live, the algorithm and key length could be made configurable in the
  future but this seems good enough to start with. Some users might also
  want to use their own CA instead of the one created by Vault, or
  export the private key when it is generated, support for this can be
  added later.
• The CA is automatically rotated when it expires in less than an
  hour. It can also be rotated by calling the ca/rotate endpoint.
  During the rotation, all plugins that are using CA authentication are
  restarted to make sure they use the new one.
• When connecting to a database, Vault uses a certificate signed by
  its CA and valid for one month. The subject name is set to the
  username used to connect to the database and this certificate is
  replaced every month or when the CA is rotated, whatever comes first.

I tested this new feature with PostgreSQL 13.3 but it should work with
any database that supports client certificate authentication.