feat: optionally store secrets in etcd rather than local filesystem

This cleans up the Depot interface and adds a --depot <depot> flag that lets you optionally store your certs/keys/config files in etcd.

By default, etcd-ca still operates "normally" with the local filesystem depot, so this is not a breaking change for users.