[mint] add new service: mint

[mint] add new service: mint

Add a mint service which can issue certificates for other service identities based on configured rules. This allows, for example, a service to use its own identity to request a temporary `etcd-client` certificate.

The mint service applies the following restrictions:

1. Only service account identities may be requested.
2. Clients are not allowed to request a certificate for their own identity.
3. Issued certificates will always use the same SPIFFE domain as the original requester's certificate.
4. Certificates issued by the mint service expire at the same time as the client certificate used to make the connection to the mint service.
5. The rules for which services are allowed to request which identities are defined in a YAML file stored in ephs at (by default) `/ephs/local/services/mint/rules.yaml`.