Vault 34905 support register ce plugin with extracted artifact

[helenfufu]

Description

This PR contains the subset of CE changes from https://github.com/hashicorp/vault-enterprise/pull/8071. It primarily refactors variable, function, and file organization such that artifact verification, and registration functionality is shared across Vault CE and ENT going forward. This artifact functionality was previously ENT-only.

PR description copied below:

Before this change, the UX for registering CE vs. ENT plugins diverges undesirably: to register a CE plugin, you must provide sha256, and to register an ENT plugin, you must provide version and omit sha256. This change brings a unified UX for registering CE vs. ENT plugins: for both cases*, an operator can provide version only (no sha256) to register with an extracted artifact.

This PR primarily refactors variable, function, and file organization such that plugin verification and registration functionality is shared across Vault CE and ENT going forward. This allows Vault (both CE and ENT) to support registering CE plugins with an extracted artifact directory when only version and no sha256 is provided, the same way that ENT plugins are registered. We will continue to support registering CE plugins with binary when sha256 is provided to maintain a backwards-compatible UX.

* Note: CE plugins will support artifact packaging on releases.hashicorp.com going forward starting with the Vault 1.20 release (after https://github.com/hashicorp/vault-plugin-release/pull/55), so the registration experience is unified on artifacts only for new versions of CE plugins. Old versions of CE plugins still need to be registered with binary.

Ticket: VAULT-34905

Local Testing

Test results: [link]

Vault CE

Auth/secrets

• Vault CE can register and use CE plugin with binary (non-versioned).
• Vault CE can register and use CE plugin with binary (versioned).
• Vault CE can register and use CE plugin with extracted artifact. (Used test vault-plugin-secrets-kv_0.18.0_darwin_arm64.zip artifact built off https://github.com/hashicorp/vault-plugin-release/pull/55: https://github.com/hashicorp/vault-plugin-release/actions/runs/14366149960)
• Vault CE cannot use ENT plugin with extracted artifact.
• Vault CE cannot use ENT plugin with binary.

Database

• Vault CE can register and use CE plugin with binary (non-versioned).
• Vault CE can register and use CE plugin with binary (versioned).
• Vault CE can register and use CE plugin with extracted artifact. (Used test vault-plugin-database-oracle_0.10.2_linux_amd64.zip artifact built off https://github.com/hashicorp/vault-plugin-release/compare/vault-34905-test-oracle-ce-artifact?expand=1: https://github.com/hashicorp/vault-plugin-release/actions/runs/15078913234)
• Vault CE cannot use ENT plugin with extracted artifact.
• Vault CE cannot use ENT plugin with binary.

TODO only if you're a HashiCorp employee

• Backport Labels: If this fix needs to be backported, use the appropriate backport/ label that matches the desired release branch. Note that in the CE repo, the latest release branch will look like backport/x.x.x, but older release branches will be backport/ent/x.x.x+ent.
  • LTS: If this fixes a critical security vulnerability or severity 1 bug, it will also need to be backported to the current LTS versions of Vault. To ensure this, use all available enterprise labels.
• ENT Breakage: If this PR either 1) removes a public function OR 2) changes the signature
  of a public function, even if that change is in a CE file, double check that
  applying the patch for this PR to the ENT repo and running tests doesn't
  break any tests. Sometimes ENT only tests rely on public functions in CE
  files.
• Jira: If this change has an associated Jira, it's referenced either
  in the PR description, commit message, or branch name.
• RFC: If this change has an associated RFC, please link it in the description.
• ENT PR: If this change has an associated ENT PR, please link it in the
  description. Also, make sure the changelog is in this PR, not in your ENT PR.

[github-actions]

CI Results:
All Go tests succeeded! ✅

[github-actions]

Build Results:
All builds succeeded! ✅

[thyton]

Excellent work and test coverages @helenfufu!

[fairclothjm]

Great work @helenfufu! I did some testing with vault-plugin-database-snowflake to test the backwards compatibility. I just left one question on the pgp key.

[fairclothjm]

Should vault fetch this from the well-known endpoint and cache it? What happens if this ever needs to change? Ideally that would not happen, but it has happened in the past.

[helenfufu]

Followed up on Slack about this question after chatting with Thy.

Thanks btw for testing with the Snowflake plugin!