IAM join method support for tbot

[nklaassen]

This PR allows tbot to get its initial certs using the IAM join method instead of a secret token.

Normal bot tokens are deleted immediately after their first use, IAM tokens will not be deleted so that they can be re-used. IAM join tokens are really only useful if they can be re-used, otherwise they just have more overhead than a secret token.

The example usecase for the IAM method would be and admin who wants to "let any node in my AWS account join as this bot user".

The usage is as follows:

1. Create bottoken.yaml

Use common IAM method fields from https://goteleport.com/docs/setup/guides/joining-nodes-aws/

Set bot_name to the bot resource name.

# bottoken.yaml
kind: token
version: v2
metadata:
  name: bot-token
  expires: "3000-01-01T00:00:00Z"
spec:
  roles: [Bot]
  bot_name: "bot-ci"
  join_method: iam
  allow:
  - aws_account: "111111111111"
    aws_arn: "arn:aws:sts::111111111111:assumed-role/ci-iam-role/i-*"

2. Create the bot

$ tctl bots add ci --roles access --token bot-token
The bot token: bot-token
This token will expire in 153722867 minutes.

Run this on the new bot node to join the cluster:

> tbot start \
   --destination-dir=./tbot-user \
   --token=bot-token \
   --ca-pin=sha256:d9dc7398e003c378e80c2fbbc6eeac7a9b0c7f7ad3384de167f87d43ccaf0a5e \
   --auth-server=10.0.0.9:3025 \
   --join-method=iam

Please note:

  - This invitation token will expire in 153722867 minutes
  - 10.0.0.9:3025 must be reachable from the new node

3. Run the tbot start command output by tctl bots add

Run this on an ec2 instance with an attached IAM role, or test it in your terminal with valid AWS credentials

[ravicious]

As I mentioned on Slack, I reviewed this to the best of my abilities even though I still need to catch up on tbot. I appreciate the PR description and the informative comments. Unfortunately, I wasn't able to properly test this PR as I don't have an AWS setup at the moment.

I see there are some failing tests related to tokens, but I'm giving an approval so that the progress on this PR isn't blocked once it gets reviewed by other people who are more familiar with this part of the codebase.

[ravicious]

"Repeatedly" here describes the overall logic, right? Like, for other join methods we repeatedly renew certs, but for EC2 and IAM we repeatedly fetch new certs?

[nklaassen]

Yes that's right, I've updated the comment to try to make it a bit more clear. Thanks for reviewing!