venafi_certificate - Add on_destroy retire/revoke capability

[markekibbe]

BUSINESS PROBLEM
Current state, the venafi_certificate resource only supports retire functionality on terraform destroy. Being able to support revocation via destroy would allow for increased capabilities for operations personnel. Some operations and policies require revocation over Venafi "Retire" capabilities.

This is noted in the venafi_provider resource documentation in a yellow note field.

PROPOSED SOLUTION
Remove this hard-coded functionality, and add to the venafi_certificate resource an "on_destroy_action" property.

This property would accept 1 of 2 values: <revoke|retire> with a resource default of retire to make this a non-breaking change for any existing implementations.

resource "venafi_certificate" "webserver" {
    common_name = "web.venafi.example"
    on_destroy_action = "revoke"
}

CURRENT ALTERNATIVES
Current solution is manual click-ops via operations teams.