- Fix problem that /etc/krb5-<name>.keytab was preferred for first service
  only when the kerbservice was explicitly defined for an issuer.  Now it
  also works for default first kerberos service.

- Update to vault-plugin-secrets-oauthapp 3.0.0-beta.4 which includes a
  replacement for PR #64.

- Updated the token exchange PR for vault-plugin-secrets-oauthapp to
    send the client secret in the initial authorization request in the
    device flow
- Updated to vault-plugin-secrets-oauthapp-2.2.0

- Update to vault-plugin-auth-jwt-0.9.4 and require vault-1.7.3

- Correctly disable secret oauth module instead of incorrect auth module
  when something changes requiring clearing out of old secrets.
- Allow dashes in names by converting them in bash variables to
  underscores, and reject any other non-alphanumeric or underscore in
  names.
- Fix bug in RFC8693 token exchange pull request to puppetlabs plugin
  which caused comma-separated scopes to get sent to the token issuer
  instead of space-separated scopes.

- Add Requires: python3-PyYAML

- Always reconfigure everything when systemd service is started, just don't
  disable/reenable oauthapp because that wipes out stored secrets.
- Support multiple roles per issuer.