Add support for additive updates to the services configuration when discovery is enabled

[tsandall]

Discovery is not currently able to update the services configuration in OPA. This was done to protect users from accidentally rendering the OPA inoperable (e.g., unable to reach the discovery service to pull down new bundles.) In some cases it would be useful to be able to add new services (e.g., when migrating from one service implementation to another.)

To enable this use case we could relax the validation done by the discovery plugin to permit additive changes to the services configuration.

[mjungsbluth]

Apart from migrations there are two other use cases where this can be useful:

1. Token exchange: If you are on AWS you can use the build in AWS IAM support in OPA to avoid propagating static tokens in your infrastructure and use the discovery to exchange the information from the signed request to a bearer token to some other service. This way you don't have to do stuff like credential rotation in a distributed environment.

2. Increase availability of Management APIs: You could run discovery as your own service but host your bundles on S3. During discovery you would return new services representing the S3 bucket(s) you want to use. In case your discovery service goes down, the OPA instances will still be able to download and refresh bundles as pretty much nothing beats the availability of S3.