adding private DNS name as EC2 metadata

[ikraemer-dd]

This PR adds a new metadata field when using IAM AWS authentication method from an EC2.

Solves #25413

I tested that it behaves as expected.

Server side configuration:

vault auth enable aws
tee cert-policy.hcl <<EOF
path "pki*" {
  capabilities = [ "create", "read", "update", "list"]
}
EOF
vault policy write cert-issuer cert-policy.hcl
vault write auth/aws/role/dev-role-iam auth_type=iam \
     token_type=service inferred_entity_type=ec2_instance inferred_aws_region=us-east-1 \
     bound_iam_instance_profile_arn="arn:aws:iam::$ACCOUNT_ID:instance-profile/$INSTANCE_PROFILE"
     policies=cert-issuer max_ttl=500h
vault write auth/aws/config/identity iam_metadata=inferred_hostname
vault secrets enable -path=pki pki
// ... configure PKI ...
vault write pki/roles/example-dot-com \
     issuer_ref="$(vault read -field=default pki/config/issuers)" \
     allowed_domains='{{identity.entity.aliases.<accessor>.metadata.inferred_hostname}}' \
     allowed_domains_template=true \
     allow_bare_domains=true \
     allow_glob_domains=true \
     allow_localhost=false \
     enforce_hostnames=false \
     generate_lease=false \
     no_store=true \
     max_ttl="720h"

Client side tests:
This is successful:

vault login -method=aws role="dev-role-iam"
HOSTNAME=$(curl -s http://169.254.169.254/latest/meta-data/local-hostname)
vault write -format=json "pki/issue/example-dot-com" \
  common_name="$HOSTNAME" > generated_example.cert.json

This fails, as expected:

vault write -format=json "pki/issue/example-dot-com" common_name="test"

with the error

Error writing data to pki/issue/example-dot-com: Error making API request.

URL: PUT http://x.x.x.x:8200/v1/pki/issue/example-dot-com
Code: 400. Errors:

* common name test not allowed by this role

[hashicorp-cla]

All committers have signed the CLA.

[kpcraig]

looks good! thanks for the contribution!