Expression resolution in the CLI process should support the same set of functionality that server side resolution does:

1) Nested expressions
2) Recursive expression resolution
3) Resolution from environment variables
4) In contexts where resolution from a vault is supported, various resolution sources should integrate cleanly; e.g. a password attribute in the SSL config element could resolve from any supported source, or from a nested expression with the nested part from one source and the outer part from another, or with a recursive expression, where the first resolution resolves from one source and a subsequent one comes from another.

Supporting vault resolution in contexts other than where it is currently supported is not part of this task.

Implementing this will likely mean largely equivalent resolution code will exist in multiple places (CLI, WFCORE controller, jboss-metadata) which somewhat screams for a common library. But that's a nice-to-have.