Add canonicalArn as a entity alias name

[thegatsbylofiexperience]

Hi,

This is another quality of life change. Using the assumed-role arn as the full_arn option has issues,
if you want predictable entity alias names -> in the case of EC2 and Code Build this is not the case.

This change adds canonical_arn as another option for identity configuration in addition to the others for IAM alias.

Thanks

[kpcraig]

Hello! I know this has been sitting for a while, and for that I apologize. This looks pretty good so far, although my understanding is there is a potential concern regarding the possibility that a future entity could be created with the same canonical ARN, and inherit access unexpectedly. As a result we'd like some documentation added to vault/website/api-docs and vault/website/docs where appropriate, similar to the warnings at auth/kubernetes.

Unfortunately I don't think I can make change suggestions on unchanged files, or I would offer one directly.

[thegatsbylofiexperience]

Hi @kpcraig,

I have added the docs as requested. Please let me know if any more changes are needed.

Regards,
:)

[kpcraig]

Thanks for the updates; again, sorry for the delay!

[kpcraig]

this probably wants a changelog but i'll put it in separately.