Update vault ca provider namespace configuration

[cthain]

Description

This PR fixes the regression described in #19051. The Vault CA provider has been updated to only set the namespace on the Vault client if it is not empty, otherwise it falls back to the base namespace configured for the provider.

Testing & Reproduction steps

A new unit test TestVaultCAProvider_EnterpriseNamespace has been created to exercise the update. This requires a local Vault Enterprise binary and license to run, otherwise the test will automatically be skipped.

$ vault version
Vault v1.15.0+ent (d3729711f875a9dedea802079cd7f0e4b1d6e8d5), built 2023-09-22T21:04:53Z
$ export VAULT_LICENSE=$(cat /path/to/vault.license)
$ go test ./agent/connect/ca -run '^TestVaultCAProvider_EnterpriseNamespace$'
ok  	github.com/hashicorp/consul/agent/connect/ca	1.916s

PR Checklist

• updated test coverage
• external facing docs updated
• appropriate backport labels added
• not a security concern

[cthain]

This check here isn't strictly necessary but it does duplicate the problem reported in the issue where the provider fails to initialize because the namespace doesn't exist.

[ilham35899]

Good

[cthain]

Maybe this mechanism is overkill but it would allow us to have other tests be discriminant about what Vault features are available to test with. For example, we could skip tests for certain Vault versions if the feature isn't applicable. Maybe this falls in the category of YNGNI, but it was super easy to implement it this way, so I did.

[cthain]

Just cleaning up code flagged by go-static-check. "Yoda" statements, like it does not.

[kisunji]

Looks great! Thanks for the thorough integration testing