[v13] Add and map the MDM system role

[codingllama]

Backport #26395 to branch/v13

Add the MDM system role and code the necessary mappings.

The PR also specializes the output for "mdm" tokens in tctl tokens add.

For example:

$ tctl tokens add --type=mdm
> The invite token: 3aca68eaccb13571cf0fb19b41fd31bd
> This token will expire in 30 minutes.
> 
> Use this token to add an MDM service to Teleport.
> 
> > teleport start \
>    --token=3aca68eaccb13571cf0fb19b41fd31bd \
>    --ca-pin=sha256:4b32d9c54b2b3332019d5f0720b8f9a603de03ace07d308bcd743465eee1f200 \
>    -c=/path/to/mdm_service.yaml

This PR is part of the groundwork necessary for the new "MDM service".

https://github.com/gravitational/teleport.e/issues/826