Bug 1637156

Copied from https://jira.coreos.com/browse/LOG-196

As a user of common logging, I want to be able to provide the authentication credentials which will be used by my log collectors to send logs to common logging.  I need to be able to

    pass certs, keys, and shared secrets securely
    configure common logging to use the CA certs I provide to authenticate the client cert auth users I will be using in my log collectors
    configure common logging to use the bearer tokens I will be using in my log collectors
    configure searchguard to allow the users I will be using in my log collectors to create and write to specified indices (e.g. project.foo., project.bar.), or patterns of indices (project.ovirt-*), or all indices (create and write to all indices - current fluentd user permissions)

I must be able to pass in secrets securely e.g. unencrypted keys must be protected e.g. ansible vault.  I must not be able to configure logging as an unauthenticated user - that is, we must prevent an attacker from being able to anonymously or using an unprivileged user configure logging to accept authentication which will allow the attacker create and write access to Elasticsearch.

For example, for client cert auth, I will pass in the CA cert file for the CA that issued the client cert; the username/subjectDN for the cert that will be used to authenticate; and a list of indices/index patterns/ALL.  Logging will be configured to allow client cert auth to Elasticsearch, and to allow the username/subjectDN to create and write the specified indices.

For token auth, I will pass in the username and a list of indices/index patterns/ALL.  Logging will be configured to accept bearer tokens and to allow a bearer token corresponding to the username to create and write the specified indices.

I should be able to pass in one or more users at a time - the interface should accept a list of auth objects.  Each auth object will contain the data necessary to configure that type of auth e.g. for client cert auth the auth object will contain the subjectDN/username and the indices/index patterns/ALL.  The CA cert is optional if the same CA was used to issue all of the cert used by Elasticsearch and the clients.  For token auth, the auth object will contain the username and the indices/index patterns/ALL.