admin: new API for creating KMS master keys (#9982)

This commit adds a new admin API for creating master keys.
An admin client can send a POST request to:
```
/minio/admin/v3/kms/key/create?key-id=<keyID>
```

The name / ID of the new key is specified as request
query parameter `key-id=<ID>`.

Creating new master keys requires KES - it does not work with
the native Vault KMS (deprecated) nor with a static master key
(deprecated).

Further, this commit removes the `UpdateKey` method from the `KMS`
interface. This method is not needed and not used anymore.

cmd/crypto/vault.go

@@ -17,6 +17,7 @@ package crypto
 import (
 	"bytes"
 	"encoding/base64"
+	"errors"
 	"fmt"
 	"strings"
 	"time"
@@ -190,20 +191,34 @@ func (v *vaultService) authenticate() (err error) {
 	return
 }
 
-// KeyID - vault configured keyID
-func (v *vaultService) KeyID() string {
+// DefaultKeyID returns the default key ID that should be
+// used for SSE-S3 or SSE-KMS when the S3 client does not
+// provide an explicit key ID.
+func (v *vaultService) DefaultKeyID() string {
 	return v.config.Key.Name
 }
 
-// Returns - vault info
-func (v *vaultService) Info() (kmsInfo KMSInfo) {
+// Info returns some information about the Vault,
+// configuration - like the endpoint or authentication
+// method.
+func (v *vaultService) Info() KMSInfo {
 	return KMSInfo{
 		Endpoint: v.config.Endpoint,
-		Name:     v.config.Key.Name,
+		Name:     v.DefaultKeyID(),
 		AuthType: v.config.Auth.Type,
 	}
 }
 
+// CreateKey is a stub that exists such that the Vault
+// client implements the KMS interface. It always returns
+// a not-implemented error.
+//
+// Creating keys requires a KES instance between MinIO and Vault.
+func (v *vaultService) CreateKey(keyID string) error {
+	// Creating new keys requires KES.
+	return errors.New("crypto: creating keys is not supported by Vault")
+}
+
 // GenerateKey returns a new plaintext key, generated by the KMS,
 // and a sealed version of this plaintext key encrypted using the
 // named key referenced by keyID. It also binds the generated key