PDP refactor phase tracker

[codingllama]

Tracker for the "refactor phase" of RFD 0193 - Access Control Decision API (aka PDP API).

Design

• RFD (https://github.com/gravitational/teleport.e/pull/5736)

Common Implementation Work

• Decision Service Plumbing
  • Protos (Add initial Decision (aka PDP) protos #49875)
  • GRPC Service Plumbing (Add the decisionv1.Service boilerplate #49912)
  • TLS Identity Helpers/Types (Add conversions to/from decisionpb.TLSIdentity #50308)
  • SSH Identity Helpers/Types (add ssh identity object #50787 and Add host fields and protos for ssh identities #51024)
  • Remote cluster pinning/mapping.
  • Helpers for setup of Authorizer/AccessChecker from TLS Identity protos without access to original cert.
  • Basic Decision API authz scheme (local tctl only initially). (Limit decision service evaluation to local admins #51083)
  • Client and server-side wrappers for filling standard metadata fields and enforcing feature assertions.
• Decision Service CLI
  • tctl subcommand boilerplate (Add tctl decision command #51094)
  • Identity generation facilities (likely a hybrid of add identity generators to decision api #50559 and Add RequestIdentityMode to PDP requests #50482)

SSH Access Refactor

• Rework common ssh cert handling logic to use new identity type instead of raw cert.
• Add local PDP setup & evaluation step prior to any enforcement not solely based on identity.
• Move all ssh decision logic behind the appropriate PDP method and convert all enforcement logic over to using the appropriate permit (note: since this will be the first true decision method, we're likely going to find some overlooked common impl work here).
• Remove roles from primary node cache interface and add plumbing for a separate interface only for use by local PDP decisions that preserves roles.

Database Access Refactor

• TODO

Desktop Access Refactor

• TODO

App Access Refactor

• TODO

Kube Access Refactor

• TODO

[codingllama]

Relevant issues from private, raised/mentioned by Forrest (FYI @fspmarshall).

• https://github.com/gravitational/teleport-private/issues/1817
• https://github.com/gravitational/teleport-private/issues/1788
• https://github.com/gravitational/teleport-private/issues/1371
• https://github.com/gravitational/teleport-private/issues/913
• https://github.com/gravitational/teleport-private/issues/471
• https://github.com/gravitational/teleport-private/issues/469

Umbrella for the various issues above:

• https://github.com/gravitational/teleport-private/issues/1818

While not necessarily blockers for the refactor phase we are considering plans right now, before we hard-commit ourselves to a certain path.

Edit: linked even more issues.