Add server-side confluentdbutil showattrib subcommand

[Obihoernchen]

This PR adds confluentdbutil showattrib <noderange> <attribute>..., which prints stored attribute values directly from the on-disk config store. Unlike nodeattrib, it reveals secret.* (decrypted plaintext, e.g. a node's BMC password) and crypted.* (stored one-way hashes). Reading the store directly, it also works while confluent is stopped. Reuses the daemon's get_node_attributes(..., decrypt=True) and formats values like nodeattrib.

Why

No supported way existed to read a secret back out. The nodeattrib/the API only report whether a secret is set (crypt attributes are masked via msg.CryptedAttributes before any transport). Pretty much every confluent user asks me about this.

Fixes: #200

Security implications

• Server-side only. Reads the config store and master key directly on disk; plaintext never crosses the socket or HTTP API. The API mask is untouched, so remote clients still cannot retrieve secrets.
• Root / confluent-user only
• Read-only, master key unlocked as the daemon does at startup (autogen=False).

Note: This capability "already existed". Any root user on the server could get the same plaintext with a few lines of Python.

Resolved open question

Showing crypted.* too: yes. They're one-way hashes, but exposing the stored hash is handy for automation and makes this a complete offline attribute reader. Now, all attributes are available via this subcommand.

[jjohnson42]

At first glance, thinking it could go for some simplification. Auditlog and checking the user explicitly I think are superfluous since this utility is just run directly as the user without setuid or setgid or any daemon wrapping it.

[Obihoernchen]

Yeah makes sense. Removed these checks.
What's your opinion on showing or not showing crypted.* values?

[jjohnson42]

Might as well show the crypted attributes, maybe of limited utility to most folks, but someone might have a use for it, like feeding it to hashcat to see how well it stands up.

[Obihoernchen]

Added crypted values and some notes to nodeattrib man pages.

[Obihoernchen]

We have no filter now so I'll just make this work for all the attributes so it can be used to get attributes if confluentd is down. This way it's even more useful than just secrets.

[Obihoernchen]

Ok I guess it's finished now and is basically an offline / server-side version of nodeattrib. I just tried to match nodeattribs output formatting but didn't implement all it's features. I think that's more than good enough for it's usecase.