Support for Vault approle workflow in consul-template.

This is a request for a consul-template enhancement to better support the Vault approle workflow.

I see consul-template as the "glue" between Vault/Consul and services which consume their secrets and discovery services. At present, services which wish to make use of both Vault's AppRole authentication backend and its Consul dynamic secret backend cannot to do so seamlessly without some enhancements to CT. (Actually, some, but not all, of this is being addressed here [issue #733](https://github.com/hashicorp/consul-template/issues/733).)

Ref's
1. https://www.hashicorp.com/blog/vault-0.6.html#response-wrapping
2. https://www.vaultproject.io/docs/auth/approle.html
3. https://www.vaultproject.io/docs/secrets/consul/index.htm
4. https://groups.google.com/forum/#!searchin/vault-tool/response$20wrapping$20app$20role%7Csort:relevance/vault-tool/w9HmAoT4d1U/KnRduSeqCAAJ

Here's a proposed workflow w/ ref's to existing HC workflow descriptions:
1. Some (unnamed) entity (a Vault client, outside of CT) which is responsible for deploying a trusted service foo in an environment will request of Vault a _wrapped_ secret_id issued against a prefined approle we wish to associate with the service.

```
$ vault write -f auth/approle/role/testrole/secret-id -wrap-ttl=20s
```

(Essentially steps 1-3 of ref.1)
2. The client, as part of the app deployment process, instantiates a consul-template daemon passing on
- the wrapped (single-use, time restricted) Vault secret_id from step 1
- an associated (non-secret) role-id
- and the desired Consul policy name (this last part is the subject of issue#733).

(Essentially step 4 of ref.1)

This is _in lieu of_ specifying vault_token and consul_token CT config parameters.
3. CT unwraps the secret_id

```
resp=$(curl -s -XPOST -H "X-Vault-Token:$wrapped_secret_id" "$vault_addr/v1/sys/wrapping/unwrap")
secret_id=$(echo $resp | jq -r .data.secret_id)
```

(Step 5&6 of Ref 1)
4. CT logs into Vault w/ secret_id + role_id to obtain Vault token

```
resp=$(curl -s -XPOST "$vault_addr/v1/auth/approle/login" -d@- <