Fix NewHeadlessAuthenticationWatcher prevents Auth initialization when the backend is unavailable

[Joerger]

Only wait for headless authentication watcher initialization in tests.

Closes #26444

[rosstimothy]

Will this cause inconsistent behavior outside of tests now? Is it possible to attempt a headless login just after Auth has been started but prior to the watcher being initialized?

[Joerger]

Will this cause inconsistent behavior outside of tests now?

This won't really be a problem. The Headless Authentication Watcher system is immune to race conditions due to the stale check logic. The problem is that the tests are trying to test specific cases (ex: watcher catches initial backend put, not stale check), so we need a way to prevent such race conditions within the tests themselves. Let me know if you think there is a better way to go about this.

Is it possible to attempt a headless login just after Auth has been started but prior to the watcher being initialized?

To be more specific, yes, this is possible. But the watcher will successfully allocate a subscriber, and do an initial backend check. Once the watcher is fully initialized, it will notify any existing subscribers:

teleport/lib/services/local/headlessauthn_watcher.go

Lines 167 to 172 in b51cef2

	// Notify any subscribers initiated before the new watcher initialized.
	headlessAuthns, err := h.identityService.GetHeadlessAuthentications(ctx)
	if err != nil {
	return trace.Wrap(err)
	}
	h.notify(headlessAuthns...)

[public-teleport-github-review-bot]

@Joerger See the table below for backport results.

Branch	Result
branch/v12	Create PR
branch/v13	Create PR