NewClient uses the AWS IAM auth method configured in a Vault cluster to authenticate the execution role and create a Vault API client.

UserAgentRequestCallback takes a function that returns a user agent string and will invoke that function to set the user agent string on the request.

Client holds api.Client and handles state required to renew tokens and re-auth as required.