Support OpenSSH Extensions: permit-X11-forwarding

[benarent]

We've a paying customer who's currently patched Teleport to support X11 forwarding as an extension for Teleport. The team then uses the certificate with OpenSSH to provide access.

We might want to consider this as an optional extension, set in the role. It should be off by default.

kind: role
metadata:
  name: clusteradmin
spec:
  allow:
...
  options:
    cert_format: standard
    forward_agent: false
    permit_x11_forwarding: true
    max_session_ttl: 12h0m0s