[tctl] Adds option to write tarred tctl auth sign output to stdout

[tcsc]

Adds a --tar option to the tctl auth sign command that bundles
the keys, certificates & other generated files to a tarball, and streams
that tarball out to stdout.

This is to facilitate extracting credentials from environments with
limited access to the filesystem and tools like a shell, tar and so
on. The motivating example is our distroless Docker images. See
#29262 for more detail.

Example usage:

❯ kubectl exec ... -- tctl auth sign --user admin-guy --format tls --ttl 10m --tar -o admin-guy | tar xv -C local
x admin-guy.crt
x admin-guy.key
x admin-guy.cas

❯ ls -l local
total 24
-rw-------  1 trent  staff  1318 Jul 24 15:52 admin-guy.cas
-rw-------  1 trent  staff  1895 Jul 24 15:52 admin-guy.crt
-rw-------  1 trent  staff  1679 Jul 24 15:52 admin-guy.key

Using --tar also hides all of the helper messages normally
generated by tctl, as writing these messages would break
the resulting tarball.

See-Also: #29262. Also closes #27639.

[hugoShaka]

This sounds good to me, my only suggestion would be to send the user messages to stderr instead of suppressing them. If we do this, we could also add a message explaining to the user how to unpack the tar.

[r0mant]

We should also update the docs to explain the usage of this flag when running teleport-cluster Helm chart. Maybe add an FAQ entry like "How do I export certificates from distroless containers?".