Ui kv preflight endpoints

[meirish]

This is the UI counterpart to #4430 and #4435.

The major change here is replacing calls to sys/mounts with sys/internal/ui/mounts and sys/internal/ui/mounts/:path - so we no longer need a fetch at the top level secrets route, and when loading individual secrets, we only need to lookup the path for the engine they're trying to view, not the whole list and then filtering for it.

The net effect is that we no longer need policy access to sys/mounts for the UI to function. As a bonus we also get a list of only the mounts that contain secrets that you have ACLs to operate on.

Here's a concrete example: Given a Vault instance with a kv backend mounted at kv/, a user logged in with a token policy of only the default policy plus a policy containing:

path "kv/*" {
  capabilities = ["create", "read", "list", "update", "delete"]
}

Would see this: