feature: Support server/client CSR-signing workflow

[Dmitrii Shcherbakov]

Currently certs and keys are generated at the vault-charm side and sent over relation data.

There is no way to support a workflow where each unit that uses vault passes a CSR over a relation and gets a certificate back so that the key is never sent over relation data.

Although sending keys over relation data is secure between units, if a unit gets compromised, it will be able to read keys of other units.

charm-vault uses an API call to generate both a key and cert:
https://www.vaultproject.io/api-docs/secret/pki/#generate-certificate

while it could just sign CSRs:
https://www.vaultproject.io/api-docs/secret/pki/#sign-certificate

https://github.com/openstack/charm-vault/blob/113975634d74f9039bb8b78508f57434e6d11542/src/lib/charm/vault_pki.py#L126