Secrets: Provide grpc and local inline secure value client (#109179)

* TestUtils: Add helper to create certs

* InlineSecureValue: Move to its own package rather than service

* Settings: Rename decrypt server configs to grpc prefixed as it is more generic

* InlineSecureValue: Add gRPC client

* InlineSecureValue: Add service provider grpc/local depending on setting.Cfg

* Wire: Add ProvideInlineSecureValueService to basic wireset

* InlineSecureValue: Re-export in root secret pkg and generate mocks for interface

* Settings: Unify decrypt+inline setting into generic grpc client

pkg/registry/apis/secret/testutils/testutils.go

@@ -6,6 +6,7 @@ import (
 
 	"github.com/grafana/authlib/authn"
 	"github.com/grafana/authlib/types"
+	"github.com/madflojo/testcerts"
 	"github.com/stretchr/testify/require"
 	"go.opentelemetry.io/otel/trace/noop"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -80,7 +81,6 @@ func Setup(t *testing.T, opts ...func(*SetupConfig)) Sut {
 	defaultKey := "SdlklWklckeLS"
 	cfg := setting.NewCfg()
 	cfg.SecretsManagement = setting.SecretsManagerSettings{
-		DecryptServerType:         "local",
 		CurrentEncryptionProvider: "secret_key.v1",
 		ConfiguredKMSProviders:    map[string]map[string]string{"secret_key.v1": {"secret_key": defaultKey}},
 	}
@@ -131,9 +131,6 @@ func Setup(t *testing.T, opts ...func(*SetupConfig)) Sut {
 	require.NoError(t, err)
 
 	testCfg := setting.NewCfg()
-	testCfg.SecretsManagement = setting.SecretsManagerSettings{
-		DecryptServerType: "local",
-	}
 
 	decryptService, err := decrypt.ProvideDecryptService(testCfg, tracer, decryptStorage)
 	require.NoError(t, err)
@@ -287,3 +284,40 @@ func CreateOBOAuthContext(
 
 	return types.WithAuthInfo(ctx, requester)
 }
+
+type TestCertPaths struct {
+	ClientCert string
+	ClientKey  string
+	ServerCert string
+	ServerKey  string
+	CA         string
+}
+
+func CreateX509TestDir(t *testing.T) TestCertPaths {
+	t.Helper()
+
+	tmpDir := t.TempDir()
+
+	ca := testcerts.NewCA()
+	caCertFile, _, err := ca.ToTempFile(tmpDir)
+	require.NoError(t, err)
+
+	serverKp, err := ca.NewKeyPair("localhost")
+	require.NoError(t, err)
+
+	serverCertFile, serverKeyFile, err := serverKp.ToTempFile(tmpDir)
+	require.NoError(t, err)
+
+	clientKp, err := ca.NewKeyPair()
+	require.NoError(t, err)
+	clientCertFile, clientKeyFile, err := clientKp.ToTempFile(tmpDir)
+	require.NoError(t, err)
+
+	return TestCertPaths{
+		ClientCert: clientCertFile.Name(),
+		ClientKey:  clientKeyFile.Name(),
+		ServerCert: serverCertFile.Name(),
+		ServerKey:  serverKeyFile.Name(),
+		CA:         caCertFile.Name(),
+	}
+}