cli: allow user to be passed into to debug zip command

[rafiss]

Addendum

The RPC on the server-side requires that the certificate used to connect is either for root or node. So the CLI change should not be made unless that changes. See:

cockroach/pkg/rpc/auth.go

Lines 315 to 332 in 0a4cbd7

	// We are using TLS, but the peer is not using a client tenant cert.
	// In that case, we only allow RPCs if the principal is 'node' or
	// 'root' and the tenant scope in the cert matches this server
	// (either the cert has scope "global" or its scope tenant ID
	// matches our own).
	//
	// TODO(benesch): the vast majority of RPCs should be limited to
	// just NodeUser. This is not a security concern, as RootUser has
	// access to read and write all data, merely good hygiene. For
	// example, there is no reason to permit the root user to send raw
	// Raft RPCs.
	certUserScope, err := security.GetCertificateUserScope(clientCert)
	if err != nil {
	return nil, err
	}
	if err := checkRootOrNodeInScope(certUserScope, a.tenant.tenantID); err != nil {
	return nil, err
	}

In order for this to be done, something like #51454 should be completed first. That issue involves re-implementing every endpoint used by debug zip in a different way, which is either a cross team project, or something that would be under the Server team.

---

cockroach debug zip only works for the root user right now. If you try to use a different user, it shows an error like:

> ./cockroach debug zip --url 'postgresql://tester@localhost:36257/defaultdb?sslcert=certs%2Fclient.tester.crt&sslkey=certs%2Fclient.tester.key&sslmode=verify-full&sslrootcert=certs%2Fca.crt' d.zip

warning: --url specifies user/password, but command "zip" does not accept user/password details - details ignored

ERROR: invalid argument "postgresql://tester@localhost:36257/defaultdb?sslcert=certs%2Fclient.tester.crt&sslkey=certs%2Fclient.tester.key&sslmode=verify-full&sslrootcert=certs%2Fca.crt" for "--url" flag: invalid file name for "sslcert": expected "client.root.crt", got "client.tester.crt"

The command should not ignore the provided user. It should also allow the --user flag to work.

Jira issue: CRDB-31775

Epic CC-25593

[knz]

xref #51454

[adbrenn]

Hi @rafiss - sorry for the naive question, but which DB would be responsible for making the necessary changes to address this issue? Thanks!