Pull identity initialization out of app building

[zaharidichev]

The purpose of this change is to allow a SPIRE identity to obtained without prior knowledge of the TLS id or the roots. In addition to that, the change enables us to construct and initialize the identity before we construct the proxy App. In order to achieve that:

• the identity config has been split into Spire and Linkerd structs
• metrics related components can be passed to the Config::build method
• the Credentials trait has been modified to accept roots in addition to the rest of the credentials
• when the app is constrcuted, it is assumed that identity has already been initialized.

TODO:

• pull pkix pem parsing crate functionality into our codebase
• conage/fix proxy initialization tests

[olix0r]

We need to be conservative about pulling in random dependencies of various maintenance statuses... especially for our TLS related dependencies.

Can we use rustls-pemfile, since we already depend on it and have a relationship with the maintainers?

Or is it possible to update the store contract to take roots as EITHER Der or PEM? Can the underlying TLS impls take either?

[olix0r]

I would like to avoid a dependency on Chrono, unless we are actually using some advanced timezone-aware time calculation feature. There's history.