actuators: Use AWS Systems Manager Parameter Store

[randomvariable]

What this PR does / why we need it:

Moves certificate authority information out of the cluster object and into AWS
Systems Manager Parameter store, removing one set of plain text secrets.

Also enables future change to clusterawsadm to be able to reconstruct the
kubeconfig without being the boootstrap user.

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Fixes #

Special notes for your reviewer:

This requires an expansion of the IAM profile as follows:

ManagedPolicyName: cluster-controller.cluster-api-provider-aws.sigs.k8s.io
  - Action:
    - ssm:GetParameter
    - ssm:GetParameters
    - ssm:GetParametersByPath
    - ssm:DeleteParameter
    - ssm:DeleteParameters
    - ssm:PutParameter
    Effect: Allow
    Resource:
    - arn:aws:ssm:*:<region>:parameter/sigs.k8s.io/cluster-api-provider-aws/certificate-authority/certificate/*
    - arn:aws:ssm:*:<region>:parameter/sigs.k8s.io/cluster-api-provider-aws/certificate-authority/private-key/*

ManagedPolicyName: nodes.cluster-api-provider-aws.sigs.k8s.io
PolicyDocument:
  Statement:
  - Action:
    - ssm:DescribeParameters
    - ssm:GetParameter
    - ssm:GetParameters
    - ssm:GetParametersByPath
    Effect: Allow
    Resource:
    - arn:aws:ssm:*:<region>:parameter/sigs.k8s.io/cluster-api-provider-aws/nodes/*
    - arn:aws:ssm:*:<region>:parameter/sigs.k8s.io/cluster-api-provider-aws/certificate-authority/certificate/*
  Version: "2012-10-17"

Parameters are written to the following locations:
/sigs.k8s.io/cluster-api-provider-aws/certificate-authority/certificate/<cluster name>
/sigs.k8s.io/cluster-api-provider-aws/certificate-authority/private-key/<cluster name>

This means that all control plane nodes for all clusters in a region have access to the
key material for all control planes if using the generated template from
clusterawsadm. It's possible to scope this further if a user applies their
own template.

Release note:

NONE

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: randomvariable
To fully approve this pull request, please assign additional approvers.
We suggest the following additional approver: detiber

If they are not already assigned, you can assign the PR to them by writing /assign @detiber in a comment when ready.

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[detiber]

Lets defer this until after the initial release, I want to make sure that we do not add any additional IAM requirements until we've had a chance to fully weight the potential consequences. This would be a great topic to discuss at the planning meeting on the 15th.

[randomvariable]

/hold

[randomvariable]

This is too out of date now.