Allow choice of Keyring to be configured in YAML

This uses a Dagger-provided map of Keyring implementations, with two currently available,
"KMS" and "Dummy". The active keyring is configured in the YAML file, so we no longer
require MOE directives to choose which one to use for internal/external builds.

-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=216898058

java/google/registry/config/files/default-config.yaml

@@ -322,14 +322,19 @@ beam:
   # The default zone to run Apache Beam (Cloud Dataflow) jobs in.
   defaultJobZone: us-east1-c
 
-kms:
-  # GCP project containing the KMS keyring. Should only be used for KMS in
-  # order to keep a simple locked down IAM configuration.
-  projectId: registry-kms-project-id
+keyring:
+  # The name of the active keyring, either "KMS" or "Dummy".
+  activeKeyring: Dummy
 
-  # The name to use for the Cloud KMS KeyRing which will store encryption keys
-  # for Nomulus secrets.
-  keyringName: nomulus
+  # Configuration options specific to Google Cloud KMS.
+  kms:
+    # GCP project containing the KMS keyring. Should only be used for KMS in
+    # order to keep a simple locked down IAM configuration.
+    projectId: registry-kms-project-id
+
+    # The name to use for the Cloud KMS KeyRing which will store encryption keys
+    # for Nomulus secrets.
+    keyringName: nomulus
 
 # Configuration options relevant to the "nomulus" registry tool.
 registryTool:

java/google/registry/config/files/nomulus-config-production-sample.yaml

@@ -61,5 +61,7 @@ cloudDns:
   rootUrl: null
   servicePath: null
 
-kms:
-  projectId: placeholder
+keyring:
+  activeKeyring: KMS
+  kms:
+    projectId: placeholder