Token identity support

[michelvocks]

With the support of ACL Templating, which allows users to dynamically build paths for the ACL system, it is requested to support the identity system for the token backend. If, for example, tokens created via a token role should have access to a dynamic path where a key/value secret is stored, the entity metadata could be used to dynamically form the related ACL policy.

One example use-case is Nomad’s integration with Vault. Nomad can automatically create Vault tokens with predefined policies which can be a subset of the originally provided policies. However, to use the ACL templating engine to dynamically build the policies paths, it is required that the entity attached to a newly created token can be dynamically modified.

This PR allows the modification of the entity alias of a token during token creation via a token role. Additionally, the entity alias modification is scoped by a predefined list of allowed entity aliases attached to the token role.

[tyrannosaurus-becks]

I think docs might also need to be updated here.

[tyrannosaurus-becks]

I think this part needs to be updated too.

[tyrannosaurus-becks]

Also the sample responses in the docs.

[michelvocks]

@tyrannosaurus-becks Thanks for the review. I've updated the PR.

Also the sample responses in the docs.

I don't really understand why the sample responses should be updated?
The default behavior and output should not change.

Cheers,
Michel

[tyrannosaurus-becks]

@michelvocks I was thinking the read role doc might need to be updated. Mainly because I thought, what if someone were building a client in another language against these API endpoints, maybe they would wonder what an entity_alias looks like in a read response. I think some of the things in our API, generally, can be tricky - durations, for instance, can be sent as strings like "10s" but then in a read response I think they can be reflected as an int showing nanoseconds. Anyways, I think there are a couple of other sample responses where it might be nice to add examples of the new fields if they're included.

[michelvocks]

@tyrannosaurus-becks Thanks for the clarification. That makes sense. I've added a few more samples. Would be great if you could have another look.

[chrishoffman]

Looking good.

[chrishoffman]

Can you also add a description to this PR? It would be good to talk about what the use-case is here in case we ever want to reference it in the future.

[jefferai]

Two minor things, looks good otherwise!

[tyrannosaurus-becks]

I second that!