Add and map the MDM system role

[codingllama]

Add the MDM system role and code the necessary mappings.

The PR also specializes the output for "mdm" tokens in tctl tokens add.

For example:

$ tctl tokens add --type=mdm
> The invite token: 3aca68eaccb13571cf0fb19b41fd31bd
> This token will expire in 30 minutes.
> 
> Use this token to add an MDM service to Teleport.
> 
> > teleport start \
>    --token=3aca68eaccb13571cf0fb19b41fd31bd \
>    --ca-pin=sha256:4b32d9c54b2b3332019d5f0720b8f9a603de03ace07d308bcd743465eee1f200 \
>    -c=/path/to/mdm_service.yaml

This PR is part of the groundwork necessary for the new "MDM service".

https://github.com/gravitational/teleport.e/issues/826

[codingllama]

Friendly ping @mdwn @strideynet @atburke ?

[codingllama]

Thanks everyone for the quick +1s.

[codingllama]

I just realized that TestLocalServiceRolesHavePermissionsForUploaderService is failing, as it wants RoleMDM to have powers to write events. Chatting with @zmb3 to figure out the best way forward.

[codingllama]

Pushed c9febe6 to address the previous comment. I'll take a look at uploader role selection in a follow-up PR.

[public-teleport-github-review-bot]

@codingllama See the table below for backport results.

Branch	Result
branch/v13	Create PR