* nomad: add admission controller framework

* nomad: add admission controller framework and Consul Connect hooks

* run admission controllers before checking permissions

* client: add default node meta for connect configurables

* nomad: remove validateJob func since it has been moved to admission controller

* nomad: use new TaskKind type

* client: use consts for connect sidecar image and log level

* Apply suggestions from code review
Co-Authored-By: Michael Schurter <mschurter@hashicorp.com>

* nomad: add job register test with connect sidecar

* Update nomad/job_endpoint_hooks.go
Co-Authored-By: Michael Schurter <mschurter@hashicorp.com>

Consul Connect must route traffic between network namespaces through a
public interface (i.e. not localhost). In order to support testing in
dev mode, users needed to manually set the interface which doesn't
make for a smooth experience.

This commit adds a facility for adding optional parameters to the
`nomad agent -dev` flag and uses it to add a `-dev=connect` flag that
binds to a public interface on the host.

NetIsolationModes and MustInitiateNetwork were left out of the
driver Capabilities when using an external task driver plugin
Signed-off-by: Lucas BEE <pouulet@gmail.com>

Add validation for kind field if it is a consul connect proxy

Ease user customizations of Makefile

Allow users to customize their makefiles by adding custom
targets/variables without checking them in.

Allow honoring `GO_TAGS` environment variable if set.  Currently, users
must set variable as a makefile argument e.g. `make GO_TAGS=ui dev`, and
this allows us to use env-var syntax (e.g. `GO_TAGS=ui make dev`) and
make it convenient to set GO_TAGS globally.

circleci: fix test reports and some refactoring

This adds the “Jump to section” feature from Terraform’s documentation.

Co-Authored-By: Michael Schurter <mschurter@hashicorp.com>

When rendering a task template, the `plugin` function is no longer
permitted by default and will raise an error. An operator can opt-in
to permitting this function with the new `template.function_blacklist`
field in the client configuration.

When rendering a task template, path parameters for the `file`
function will be treated as relative to the task directory by
default. Relative paths or symlinks that point outside the task
directory will raise an error. An operator can opt-out of this
protection with the new `template.disable_file_sandbox` field in the
client configuration.

pulls in configuration option for blacklisting template functions from:
https://github.com/hashicorp/consul-template/pull/1243
https://github.com/hashicorp/consul-template/pull/1246

pulls in configuration option for file sandboxing from:
https://github.com/hashicorp/consul-template/pull/1249
https://github.com/hashicorp/consul-template/pull/1254

pulls in vault KVv2 read fixes from:
https://github.com/hashicorp/consul-template/pull/1253

Add CircleCI Configuration

This commit provides an initial migration of general testing CI
infrastructure to CircleCI.

It uses CircleCI 2.1 paramereterised jobs to provide two base
configurations: a vm based `test-machine`, and docker based
`test-container`.

Jobs that require root, docker, or other similar features require the
machine based jobs, but others should be ran using the `test-container` package
as they are both cheaper and faster to run.

make: always honor GO_TAGS in dev

GOTEST_PKG_EXCLUDE overrides GOTEST_PKG entirely, so having both in
the same test run isn't supported and results in a whole lot of extra
tests being run.

Host Volumes Support: Rollup Edition