Support Alias Mapping for Confluent Cloud

[christophschubert]

Problem description: Service-accounts in Confluent Cloud can be referenced as principals of the form User:12345 in ACLs, where 12345 is the service account ID. Since the ID of a service account is assigned internally, we have no control about which IDs will be used.
Moreover, we might want to reuse a description in another Confluent Cloud organization. In this case, the service account IDs will also be different.

Proposed solution: support principal-aliases as follows. Add a new type Alias (besides User and Group) to the domain description. Upon calling kst, a alias map mapping alias names to principals can be provided. The alias map is used to translate the aliases in the cluster-state before the diff is performed.

[christophschubert]

Preliminary implementation done. Can be tested by setting

export KST_PRINCIPAL_MAPPING=User:xxx,User:new\;Group:StreamTeam,Group:DreamTeam