KIP-371 — Add a configuration to build custom SSL principal name

Accepted Kafka 2.2 Security

Adds an `ssl.principal.mapping.rules` config that accepts a list of regex substitution rules to transform an SSL certificate's X.500 Distinguished Name into a short `KafkaPrincipal` username. By default, SSL principals are the full DN string (`CN=writeuser,OU=Unknown,...`), which is unwieldy for ACLs and operator tooling.

Details