Unable to migrate vault secrets after a re-configuration

[Jacopo Rota]

As per title, it's not possible to migrate the vault secrets after a re-configuration of the vault.

Steps to reproduce:

1) Configure the vault for the first time
`sudo maas config-vault configure <url> <role_id> <wrapped_secret> <secret_path> --mount <mount_path>`

2) Migrate the secrets
`sudo maas config-vault migrate`
Success!

3) Configure another vault
`sudo maas config-vault configure <url2> <role_id> <wrapped_secret> <secret_path> --mount <mount_path>`
This region already has Vault configured. Overwrite the existing vault configuration? (y/n): y
Vault successfully configured for the region!
Once all regions in cluster are configured, use the following command to migrate secrets:

sudo maas config-vault migrate

4) sudo maas config-vault migrate
CommandError: Secrets are already migrated to Vault.

The end result is an environment that does not work anymore at the first restart of the application. This is because the region would be configured to use another vault with no secrets. The simple fix is to re-configure the vault with the previous configuration.

Looking at the code, it looks like we don't handle the scenario to migrate the secrets from vault to vault. We have two options:
1) Handle this case
2) Don't handle it, but then the second `sudo maas config-vault configure` should not re-configure the region but raise an error instead.

[Adam Collard (adam-collard)]

We are currently misleading people by saying that:

```
Once all regions in cluster are configured, use the following command to migrate secrets:

sudo maas config-vault migrate
```

when the user has reconfigured MAAS to point at a new Vault.

Make it much clearer in the error message and confirmation step that

a) the secrets in <OLD-VAULT> will no longer be accessible by MAAS
b) it's the user's responsibility to move secrets from <OLD-VAULT> to <NEW-VAULT> and they should refer to Vault documentation for doing so.
c) retain the message when we are migrating secrets from MAAS to Vault

Docs should be clarified that `config-vault migrate` is *just* about the one way migration from MAAS to Vault and shouldn't be needed to be run more than once.

[Jacopo Rota (r00ta)]

Had a meeting with @bill and @anton.

Considering that
- we don't support downgrade-migration from vault to database
- we don't support migration from vault to vault

we decided that we have to make clear to the CLI users that if they run `sudo maas config-vault configure <url2> <role_id> <wrapped_secret> <secret_path> --mount <mount_path>` they must have migrated the secrets to the new vault by themselves.

I will provide a patch in the next days. For these reasons, we are removing the dependency to the docs.