cli/flags,config: new flag for tenant KV listen addr

This patch introduces the ability to split off the tenant KV server into a
separate port, using the new command-line flag `--tenant-addr`.

This is motivated primarily by security concerns. We plan to use different
TLS configs for KV<->KV kv/replication/gossip traffic and SQL<->KV tenant
kv traffic. The easiest way to facilitate this is to listen to tenant KV
traffic on a separate port and separate gRPC server.

The `--tenant-addr` and `--advertise-tenant-addr` flags are inspired by the
`--sql-addr` and `--advertise-sql-addr` flags. The two pairs have similar
fallback behavior, as is discussed in depth in 6cb71bf.

This commit gets as far as, but down not introduce, the gRPC server split.
It leaves a TODO where that will be needed (in `Server.startListenRPCAndSQL`).

pkg/base/addr_validation.go

@@ -69,6 +69,22 @@ func (cfg *Config) ValidateAddrs(ctx context.Context) error {
 	}
 	cfg.SQLAddr = net.JoinHostPort(sqlHost, sqlPort)
 
+	// Validate the tenant advertise address. Use the provided advertise
+	// addr as default.
+	advTenantHost, advTenantPort, err := validateAdvertiseAddr(ctx,
+		cfg.TenantAdvertiseAddr, "--tenant-addr", cfg.TenantAddr, advHost)
+	if err != nil {
+		return errors.Wrap(err, "invalid --advertise-tenant-addr")
+	}
+	cfg.TenantAdvertiseAddr = net.JoinHostPort(advTenantHost, advTenantPort)
+
+	// Validate the tenant listen address - use the resolved listen addr as default.
+	tenantHost, tenantPort, err := validateListenAddr(ctx, cfg.TenantAddr, listenHost)
+	if err != nil {
+		return errors.Wrap(err, "invalid --tenant-addr")
+	}
+	cfg.TenantAddr = net.JoinHostPort(tenantHost, tenantPort)
+
 	// Validate the HTTP advertise address. Use the provided advertise
 	// addr as default.
 	advHTTPHost, advHTTPPort, err := validateAdvertiseAddr(ctx,
@@ -321,6 +337,9 @@ func (cfg *Config) CheckCertificateAddrs(ctx context.Context) {
 		}
 	}
 
+	// TODO(tbg): Verify that the tenant listen and advertise addresses are
+	// compatible with the provided certificate.
+
 	// Verify that the http listen and advertise addresses are
 	// compatible with the provided certificate.
 	certInfo = cm.UICert()