add identity generators to decision api

[fspmarshall]

Adds methods to the decision service for generating simulated identities for use in auditing/introspection queries. I.e. if a user with sufficient privileges wants to inspect the result of decisions about a 3rd party but does not have access to that 3rd party's certificate, the user can instead invoke this API to get an approximation of what that user's identity object should look like. Ex:

rsp, _ := ctl.GetSimulatedSSHIdentity(ctx, decision.GetSimulatedSSHIdentityRequest{
    Username: "alice@example.com",
  // ...
})

decision, _ := clt.EvaluateSSHAccess(ctx, decision.EvaluateSSHAccessRequest{
    SshIdentity: rsp.SshIdentity,
    // ...
})

In the future, the request objects will likely be augmented with additional parameters to simulate stateful identity elements such as access requests without needing to generate actual access requests.

This is an alternative to #50482