Backport of Support vault namespaces in connect CA into release/1.12.x

[hc-github-team-consul-core]

Backport

This PR is auto-generated from #12904 to be assessed for backporting due to the inclusion of the label backport/1.12.

The below text is copied from the body of the original PR.

---

Follow on to some missed items from #12655

Description

From an internal ticket "Support standard "Vault namespace in the
path" semantics for Connect Vault CA Provider"

Vault allows the namespace to be specified as a prefix in the path of
a PKI definition, but our usage of the Vault API includes calls that
don't support a namespaced key. In particular the sys.* family of
calls simply appends the key, instead of prefixing the namespace in
front of the path.

Unfortunately it is difficult to reliably parse a path with a
namespace; only vault knows what namespaces are present, and the '/'
separator can be inside a key name, as well as separating path
elements. This is in use in the wild; for example
'dc1/intermediate-key' is a relatively common naming schema.

Instead we add two new fields: RootPKINamespace and
IntermediatePKINamespace, which are the absolute namespace paths
'prefixed' in front of the respective PKI Paths.

Testing & Reproduction steps

[ ] manual testing

Links

Asana task

PR Checklist

• updated test coverage
• external facing docs updated
• not a security concern
• checklist folder consulted

Signed-off-by: Mark Anderson [email protected]

[hashicorp-ci]

🤔 This PR has changes in the website/ directory but does not have a type/docs-cherrypick label. If the changes are for the next version, this can be ignored. If they are updates to current docs, attach the label to auto cherrypick to the stable-website branch after merging.

[boruszak]

Minor suggestions - otherwise LGTM!