[VAULT-3379] Add support for contained DBs in MSSQL root rotation and lease revocation

[vinay-gopalan]

This PR adds a containedDB field to the Vault plugin's MSSQL implementation in order to support contained DBs like AzureSQL that do not allow cross DB queries and don't have server logins. This boolean field can be set to skip server login checks during root rotation and also execute a default user deletion query for lease revocation if no revocation statements are provided:

"DROP USER IF EXISTS [{{name}}]"

Fixes #10806
Closes #12830

This PR also updates the dependency github.com/denisenkom/go-mssqldb to v0.11.0 and resolves panics in closing SQL connections. A bug in the tests where users were not being deleted after each test has also been fixed.

TODO: Update docs to state the use of containedDB and include the default user deletion query.

Output from acceptance tests (need to follow setup steps listed here):

make test TEST=./plugins/database/mssql                                    
==> Checking that build is using go version >= 1.16.7...
==> Using go version 1.17...
ok      github.com/hashicorp/vault/plugins/database/mssql       (cached)


make test TESTARGS="-count=1" TEST=./plugins/database/mssql
==> Checking that build is using go version >= 1.16.7...
==> Using go version 1.17...
ok      github.com/hashicorp/vault/plugins/database/mssql       0.978s

[vinay-gopalan]

Default user deletion query for contained DBs. Since there are no server logins or database logins, we can simply drop the user. User still needs permissions and this is only in the case that no revocation statements are provided

[calvn]

updateUserPass on L346 can set a query that calls alterLoginSQL which contains ALTER LOGIN ... if changePass.Statements.Commands is empty. This may not work with contained DBs though.

[vinay-gopalan]

updateUserPass on L346 can set a query that calls alterLoginSQL which contains ALTER LOGIN ... if changePass.Statements.Commands is empty. This may not work with contained DBs though.

@calvn good call! Updated to check if DB is contained on L346

[calvn]

Looks good, but let's force an acceptance test re-run by passing TESTARGS="-count=1" as well.