Fixed token metadata for policy templating

[h33p]

Is your feature request related to a problem? Please describe.
There is a clear demand to template policies based on token metadata. Currently, there is no way to do so, because of potential security risks of child tokens changing their metadata and walking around policies.

Here's an example issue: #10460

Describe the solution you'd like
The solution could work analogously to orphan tokens. I have 2 possible options:

We can create "fixed" metadata with one the following:

1. sudo or root access to the auth/token/create and setting fixed_metadata parameter to true.
2. Access to the auth/token/create/:role that has fix_metadata set.

Then policies may template {{ token.metadata }}, if and only if fixed_metadata is set to true. Pseudocode of how this would be handled in code:

def metadata_key(self, key):
    if not self.fixed_metadata or not key in self.metadata:
        return None
    self.metadata[key]

fixed_metadata "sticks" to all child non-orphan tokens, and whenever that key is set to true, the token is refused write access to token metadata.

Another option would be additional field in tokens, called fixed_metadata. We can create "fixed" metadata with one of the following:

1. sudo or root access to the auth/token/create and setting fixed_metadata parameter to the metadata we want to fix to the token.
2. Access to the auth/token/create/:role that has fix_metadata set to true, and setting fixed_metadata to the metadata we want to fix to the token.

Same as the previous option, fixed_metadata "sticks" to all child non-orphan tokens.

Describe alternatives you've considered
Multiple AppRoles. While that works, it limits flexibility a lot, because we have a generic model of where we put secrets for different apps, and keeping track of that in terraform is very verbose. All we want is the following policy:

path "secret/data/{{ token.metadata.subpath }}/*" {
    capabilities = ["read", "list"]
}

path "secret/metadata/{{ token.metadata.subpath }}/*" {
    capabilities = ["read", "list"]
}