Adds support for kubernetes_users, extend interpolation (#3404)

[klizhentas]

This commit fixes #3369, refs #3374

It adds support for kuberenetes_users section in roles,
allowing Teleport proxy to impersonate user identities.

It also extends variable interpolation syntax by adding
suffix and prefix to variables and function email.local:

Example:

kind: role
version: v3
metadata:
  name: admin
spec:
  allow:
    # extract email local part from the email claim
    logins: ['{{email.local(external.email)}}']

    # impersonate a kubernetes user with IAM prefix
    kubernetes_users: ['IAM#{{external.email}}']

  # the deny section uses the identical format as the 'allow' section.
  # the deny rules always override allow rules.
  deny: {}

Some notes on email.local behavior:

• This is the only function supported in the template variables for now
• In case if the email.local will encounter invalid email address,
  it will interpolate to empty value, will be removed from resulting
  output.

Changes in impersonation behavior:

• By default, if no kubernetes_users is set, which is a majority of cases,
  user will impersonate themselves, which is the backwards-compatible behavior.

• As long as at least one kubernetes_users is set, the forwarder will start
  limiting the list of users allowed by the client to impersonate.

• If the users' role set does not include actual user name, it will be rejected,
  otherwise there will be no way to exclude the user from the list).

• If the kuberentes_users role set includes only one user
  (quite frequently that's the real intent), teleport will default to it,
  otherwise it will refuse to select.

  This will enable the use case when kubernetes_users has just one field to
  link the user identity with the IAM role, for example IAM#{{external.email}}

• Previous versions of the forwarding proxy were denying all external
  impersonation headers, this commit allows 'Impesrsonate-User' and
  'Impersonate-Group' header values that are allowed by role set.

• Previous versions of the forwarding proxy ignored 'Deny' section of the roles
  when applied to impersonation, this commit fixes that - roles with deny
  kubernetes_users and kubernetes_groups section will not allow
  impersonation of those users and groups.

[klizhentas]

@fspmarshall @russjones this is a forward port

[webvictim]

kubernetes

[webvictim]

kubernetes

[klizhentas]

retest this please