Use go mod for github.com/hashicorp/go-bindata/go-bindata and
github.com/elazarl/go-bindata-assetfs/go-bindata-assetfs but use
`@master` to pull the latest master.  These packages don't have release
tags so `@master` worksaround it.

* Node/monolith plugins require root privileges and this wasn't being
  made super clear.
* Node/monolith plugins should always be run as system jobs.

ar/bridge_networking: ensure cni configuration is loaded

tr/service_hook: prevent Update from running before Poststart finish

UI: Change CSI to Storage and mark it as beta

This closes #7456. It hides the terminal when the job is dead and
displays an error when trying to open an exec session for a task
that isn’t running. There’s a skipped test for the latter behaviour
that I’ll have to come back for.

This closes #7454. It makes use of the existing watchable tools to
allow the exec popup sidebar to be live-updating. It also adds
alphabetic sorting of task groups and tasks.

add note about query params for filtering

Fixes bug that prevented group shutdown_delay updates

UI: CSI Acceptance Tests

Group shutdown delay updates were not properly handled in Update hook.
This commit also ensures that plan output is displayed.

The `Job.Deregister` call will block on the client CSI controller RPCs
while the alloc still exists on the Nomad client node. So we need to
make the volume claim reaping async from the `Job.Deregister`. This
allows `nomad job stop` to return immediately. In order to make this
work, this changeset changes the volume GC so that the GC jobs are on a
by-volume basis rather than a by-job basis; we won't have to query
the (possibly deleted) job at the time of volume GC. We smuggle the
volume ID and whether it's a purge into the GC eval ID the same way we
smuggled the job ID previously.

The CSI plugins uses the external volume ID for all operations, but
the Client CSI RPCs uses the Nomad volume ID (human-friendly) for the
mount paths. Pass the External ID as an arg in the RPC call so that
the unpublish workflows have it without calling back to the server to
find the external ID.

The controller CSI plugins need the CSI node ID (or in other words,
the storage provider's view of node ID like the EC2 instance ID), not
the Nomad node ID, to determine how to detach the external volume.

Authenticate alloc/exec websocket requests

It was designed to be used this way, but allocationFor has never
worked as intended 🤦