ceph: auth: add a read-only cipher migration report

Ceph 19.2.6 and 20.2.4 flag every cephx key that still uses the old
aes cipher, two of those checks as HEALTH_ERR, so an upgraded cluster
stays in HEALTH_ERR until its keys are migrated. An operator has to
combine five things by hand to find out what to do next: 'auth
dump-keys', 'mon dump', 'ceph versions', the monitor features, and the
kernel release of every node.

'pveceph auth status' collects those facts and answers the three
questions that decide the next step: whether a rolling restart is
still needed, whether the service keys can move now, and whether the
client keys can move at all. The last one depends on the kernel,
because the in-kernel Ceph clients only support aes256k from 7.0 on.

The report is read-only. It judges the health checks with the same
code as the rolling restart, so the two cannot disagree. Every mon
command is wrapped, because a release from before the cipher answers
none of them, and a missing piece is then reported as unknown instead
of as an all-clear.

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>