Issue dynamic database credentials from HashiCorp Vault for MySQL

Steps

1. Enable the database secrets engine (vault secrets enable database) and configure a connection for MySQL using the mysql-database-plugin, supplying the connection URL with a privileged account that can create users
2. Create a Vault role (vault write database/roles/<name>) specifying creation_statements with the SQL to grant appropriate privileges, and set a TTL and max TTL for the dynamic credentials
3. Applications authenticate to Vault and read database/creds/<role> to receive a dynamically created username and password valid for the lease duration
4. Configure the application to handle lease renewal (vault lease renew) before expiry, or to re-read credentials and reconnect when a lease expires
5. Revoke credentials explicitly on application shutdown or credential compromise by calling vault lease revoke; Vault will drop the database user
6. Audit Vault's audit log to trace which application entity requested which credentials and when they were revoked