Add new configurable bootstrap writers (#2405) (#5114)

* Add new configurable bootstrap writers (#2405)

This PR adds the ability to configure different backends to use for
storing modifications to the zero bootstrap config. The two currently
implemented backends allow writing changes to a file or to a Kubernetes
secret. Backend selection is determined by the scheme in a URI passed to
the flag '--config-writeback-uri'.

In a Kubernetes environment, where the bootstrap config is mounted into
the pod from a secret, this option allows Pomerium to write changes back
to the secret, as writes to the mounted secret file on disk are not
persisted.

* Use env vars for bootstrap config filepath/writeback uri

* linter pass and code cleanup

* Add new config writer options mechanism

This moves the encryption cipher parameter out of the WriteConfig()
method in the ConfigWriter interface and into a new ConfigWriterOptions
struct. Options (e.g. cipher) can be applied to an existing ConfigWriter
to allow customizing implementation-specific behavior.

* Code cleanup/lint fixes

* Move vendored k8s code into separate package, and add license header and package comment

internal/zero/bootstrap/writers/writers_test.go

@@ -0,0 +1,38 @@
+package writers_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/pomerium/pomerium/internal/zero/bootstrap/writers"
+)
+
+func TestNewForURI(t *testing.T) {
+	for _, tc := range []struct {
+		uri string
+		err string
+	}{
+		{
+			uri: "/foo",
+			err: "unknown scheme: \"\"",
+		},
+		{
+			uri: "foo://bar",
+			err: "unknown scheme: \"foo\"",
+		},
+		{
+			uri: "foo://\x7f",
+			err: "malformed uri: parse \"foo://\\x7f\": net/url: invalid control character in URL",
+		},
+	} {
+		w, err := writers.NewForURI(tc.uri)
+		if tc.err == "" {
+			assert.NoError(t, err)
+			assert.NotNil(t, w)
+		} else {
+			assert.EqualError(t, err, tc.err)
+			assert.Nil(t, w)
+		}
+	}
+}