provide a read-only api server

[ctron]

There should be an api server process (dedicated binary or sub-command in trustd) which only exposed read-only APIs.

The idea is to work with read-only replicas of the database.

[ctron]

@JimFuller-RedHat IIRC you mentioned that pg bouncer is a more appropriate way dealing with this. If so, we can close this.

[ctron]

I'd like to reopen this. AWS aurora has the concept of reader and writer instances. For read only operations, it may be beneficial to use this concept: https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/rds-proxy-endpoints.html#rds-proxy-endpoints-reader

Instead of having a dedicated api server, I think we should configure two instances (R/W and R/O) and use that internally.