sds: additional support for symlink-based key rotation.

[htuch]

There are a few limitations in our existing support for symlink-based
key rotation:

• We don't atomically resolve symlinks, so a single snapshot might have
  inconsistent symlink resolutions for different watched files.
• Watches are on parent directories, e.g. for /foo/bar/baz on /foo/bar,
  which doesn't support common key rotation schemes were /foo/new/baz
  is rotated via a mv -Tf /foo/new /foo/bar.

The solution is to provide a structured WatchedDirectory for Secrets to
opt into when monitoring DataSources. SDS will used WatchedDirectory
to setup the inotify watch instead of the DataSource path. On update, it will
read key/cert twice, verifying file content hash consistency.

Risk level: Low (opt-in feature)
Testing: Unit and integration tests added.

Fixes #13663
Fixes #10979
Fixes #13370

Signed-off-by: Harvey Tuch htuch@google.com