Refactor web UI file transfers to use sftp package

[capnspacehook]

The sftp package is where modern file transfer logic lives and is being maintained. Make the web UI use this package to unify how we transfer files.

Closes #23595.

[zmb3]

Please make sure file transfers still work when per session MFA is enabled.

Cc @avatus

[avatus]

Please make sure file transfers still work when per session MFA is enabled.

Cc @avatus

Tested locally and the current iteration has per-session-mfa still working. I also love that this doesn't change anything on the frontend so, 👍 from me

[avatus]

A couple notes from local testing.

1. file transfers are way faster now, super sweet!!
2. I recently merged a PR to let this through if the request includes some env vars related to a moderated session. You have included the env vars in this PR which is great thank you!
3. Downloading file transfers aren't blocked on the web after this change. tsh tcp was fixed here by adding in the CheckSFTPAllowed but I think we are skipping this now on the web with the c.IsHTTPResponse block. I think we'll have to do some check similar to my linked PR above where we prevent downloads from a user that requires moderation unless those envvars exist/are valid. Let me know what you think!

[capnspacehook]

@avatus thanks for manually testing! I think I fixed the file transfer check, can you take a look and make sure everything looks good?

[avatus]

Looks and works great!

[capnspacehook]

Friendly ping @strideynet

[strideynet]

Should these errors be wrapped so we get a trace to within this function ?

[capnspacehook]

I actually was thinking about that and forgot to do something about it... These should probably be normal errors constructed from errors.New and wrapped when returned, yeah.

[capnspacehook]

Actually since trace.AccessDenied takes strings, I guess errCannotStartUnattendedSession needs to be a string constant. You think I should drop the err prefix though since it's not an error?

[capnspacehook]

I opted to just wrap the existing errors, though imo that's not ideal as the trace will include the var block the errors are defined in. Maybe we need to add functions to the trace package to wrap existing errors with a flavor, ie AccessDenied or something.