Publish join tokens to parameter store

[klizhentas]

Publish and rotate join tokens to SSM parameter store and show how nodes can use the data to join the cluster.

[kontsevoy]

Implementation proposal:

auth_service:
    token_publish: /path/to/executable {{token}} {{purpose}}

Where "token" gets substituted with the generated token and "purpose" is one of the same values we already use in "tokens" section, i.e. "node", "user", etc.

This provides a generic way for forwarding tokens dynamically to external secret store on any infrastructure. Also, users can stick their own additional arguments in-between our own.

[kontsevoy]

Implementation proposal 2: "Inversion of control"

Instead of pushing Teleport-generated tokens, consider an external source of tokens, i.e. users can use anything they like to generate a token and publish it anywhere they want. This way we need to add --token parameter to tctl node add.

The more I think about it, the more I like it.

[klizhentas]

for the first proposal, we would not even need additional configuration section. I wanted to see if I can get away with a cron job that uses existing CLI and uses our resources to produce tokens.