Add Vault Transit KMS client

[mrendi29]

Addresses #14437

We are planning to use HashiCorp Vault Transit engine as our KMS of choice. This is the preliminary client that we are using so far so I thought to contribute this back to the community.

[mrendi29]

cc @ggershinsky

[ggershinsky]

Thanks @mrendi29 . I don't have much experience with the Vault. But from the Iceberg encryption interface pov, this looks good.

[nandorKollar]

I learned before that adding a new dependency also requires adding license information to LICENSE file.

[nandorKollar]

@nastra @amogh-jahagirdar what do you think, how can Iceberg support key management solutions other than the cloud provider's solution? Instead of adopting the key management client implementation itself, should Iceberg instead provide an option to dynamically load (maybe there's already an option like this?) the key management implementation with the parameters?

[nandorKollar]

Okay, never mind, I found the answer, looks like dynamic loading of KeyManagementClient is supported by encryption.kms-impl.

[nandorKollar]

Although the ultimate decision is up to the project PMCs, I personally think that it is probably not a good idea to put this in the core module. Putting it there means that everyone, who uses Iceberg will also take the risk (I refer here mostly to security risks) of the additional dependency required for interaction with HashiCorp vault (not to mention the minimal risk of the client implementation itself), even when they don't need it at all. Other key vault clients are implemented within a cloud provider specific module.