[CDRIVER-4276] On-demand Credentials Callback for CSFLE (#1051)

This implements a credentials callback for client-side encryption.
This relates to CDRIVER-4276, although that ticket also concerns
itself with server auth on AWS, which is not implemented as part
of this change.

* Initial simple credentials callback impl
* Allow the user-provided callback to set an error
* Tests for KMS on-demand callback
* Only run callback tests if we have CSE enabled
* Add docs for new callback APIs