Support running plugins in isolated containers (#22712)

Implements running plugins in containers to give them some degree
of isolation from the main Vault process and other plugins. It only
supports running on Linux initially, where it is easiest to manage unix
socket communication across the container boundary.

Additionally

* Adds -env arg to vault plugin register.
* Don't return env from 'vault plugin info'

Historically it's been omitted, and it could conceivably have secret information in
it, so if we want to return it in the response, it should probably only be via explicit
opt-in. Skipping for now though as it's not the main purpose of the commit.

sdk/helper/pluginutil/runner.go

@@ -5,6 +5,7 @@ package pluginutil
 
 import (
 	"context"
+	"strings"
 	"time"
 
 	log "github.com/hashicorp/go-hclog"
@@ -54,6 +55,7 @@ type PluginRunner struct {
 	Type           consts.PluginType           `json:"type" structs:"type"`
 	Version        string                      `json:"version" structs:"version"`
 	Command        string                      `json:"command" structs:"command"`
+	OCIImage       string                      `json:"oci_image" structs:"oci_image"`
 	Args           []string                    `json:"args" structs:"args"`
 	Env            []string                    `json:"env" structs:"env"`
 	Sha256         []byte                      `json:"sha256" structs:"sha256"`
@@ -61,6 +63,24 @@ type PluginRunner struct {
 	BuiltinFactory func() (interface{}, error) `json:"-" structs:"-"`
 }
 
+// BinaryReference returns either the OCI image reference if it's a container
+// plugin or the path to the binary if it's a plain process plugin.
+func (p *PluginRunner) BinaryReference() string {
+	if p.Builtin {
+		return ""
+	}
+	if p.OCIImage == "" {
+		return p.Command
+	}
+
+	imageRef := p.OCIImage
+	if p.Version != "" {
+		imageRef += ":" + strings.TrimPrefix(p.Version, "v")
+	}
+
+	return imageRef
+}
+
 // SetPluginInput is only used as input for the plugin catalog's set methods.
 // We don't use the very similar PluginRunner struct to avoid confusion about
 // what's settable, which does not include the builtin fields.