Support brokers that returns credhub refs

[gberche-orange]

With upcoming credhub support in cloudfoundry, see specs https://docs.google.com/document/d/1Sp7gNqyOyJgsaMUIGde6BCvSiqwvSQQK9PNdZycIBnM/edit# the brokers are expected to move from returning plain credentials such as

{
  "credentials": {
    "access_token_uri": "https://p-example-services.cf.example.com/oauth/token",
    "client_id": "p-example-server-876cd13b-1564-4a9a-9d44-c7c8a6257b73",
    "client_secret": "rU7dMUw6bQjR",
    "uri": "https://config-86b38ce0-eed8-4c01-adb4-1a651a6178e2.apps.example.com"
    }
}

into credhub references of the following form, after having written them into credhub:

{
  "credentials": {
    "credhub-ref": "((/c/p-example-services/p-example-server/86b38ce0-eed8-4c01-adb4-1a651a6178e2/credentials-json))"
  }
}

sec-group-broker filter currenty parses returned credentials values to extract IP and ports that are then specified in the dynamically created ASG.

This issue describes how brokers that will return credhub refs can be supported by sec-group-broker filter.

Suggestion is to have the sec-group-broker filter be granted credhub permissions to invoke the interpolate credhub endpoint in order to fetch credentials from credhub and parse them to extract IP/ports.

---

• GIVEN a credhub path /c/p-example-services/p-example-server/86b38ce0-eed8-4c01-adb4-1a651a6178e2/credentials-json with the following content

   "uri": "redis://password@192.168.1.1:4040/database?timeout=10"

• WHEN a service binding is received
• AND a brokered binding response is

{
  "credentials": {
    "credhub-ref": "((/c/p-example-services/p-example-server/86b38ce0-eed8-4c01-adb4-1a651a6178e2/credentials-json))"
  }
}

• THEN an ASG is opened for IP=192.168.1.1 and port =4040
• AND the returned service binding credentials is

{
  "credentials": {
    "credhub-ref": "((/c/p-example-services/p-example-server/86b38ce0-eed8-4c01-adb4-1a651a6178e2/credentials-json))"
  }
}