Check if resource request is possible before attempting

[nklaassen]

Currently if a user attempts tsh ssh user1@node1 where they are allowed to list node1 but not login with user1, tsh will attempt to create a resource access request for it even if the user is not allowed to create any resource requests (no configured search_as_roles). This is a regression caused by #13326.

The change here is to attempt to populate and validate the request on the server side, without actually creating the request by setting a dry_run flag. If there is any error, fail immediately with the original SSH error and do not prompt the user for a request reason or attempt to create an access request.

The server side validation is better than anything we can do client side because it actually has access to all roles, including roles the user does not currently have but could potentially request.

Another improvement with this change, tsh ssh user1@node1 will never prompt the user to create an access request if the user is not able to request access to node1 with login user1 but could with another login (the current check does not consider logins until after prompting the user and attempting to create the request).

The validation is slightly less smart if the requested node is in a leaf cluster - auth doesn't know about the leaf roles that will be mapped, but will still return an error if the user has no search_as_roles configured OR cannot list the node, so this will still be an improvement.

Before this change:

Nics-MacBook-Pro:teletest nklaassen$ tsh ssh ubuntu@one-node
ERROR: access denied to ubuntu connecting to one-node on cluster cluster-one

You do not currently have access to ubuntu@one-node, attempting to request access.

Enter request reason: pretty please
Creating request...
ERROR: user does not have any "search_as_roles" which are valid for this request

After this change:

Nics-MacBook-Pro:teletest nklaassen$ tsh ssh ubuntu@one-node
ERROR: access denied to ubuntu connecting to one-node on cluster cluster-one

[github-actions]

@nklaassen See the table below for backport results.

Branch	Result
branch/v10	Failed