Support a pluggable key management system (KMS)

Different runners want to have access to various cloud providers such as AWS, Azure, GCP yet still provide users the ability to have control over access to those resources.

Adding support for a pluggable key management solution would allow users to have control over which resources are accessed and when.

Some concrete scenarios would be:

• Access S3 and GCS from a Yarn cluster running on AWS.
• Control S3 resource access for pipelines executing on Google Cloud Dataflow