Implement KMS provider

[dgreene-r7]

Tokend has a pretty steep set of dependencies in Warden and Vault. Implementing a KMS provider would provide a single dependency and make for easier adoption.

This provider will implement the following endpoint: /v1/kms/decrypt. It will only accept POST requests and requires a body with a ciphertext key whose value is the encrypted secret from KMS.

The response from the endpoint will be:

{
  "keyid": "<ARN OF KEY USED TO ENCRYPT>",
  "plaintext": "<SECRET>"
}

Like the TransitProvider this is a non-renewable secret.

[dgreene-r7]

This is resolved by #99!