Add preset device trust roles

[codingllama]

Add the following preset/example roles:

• device-admin (as shown by device trust docs)
• device-enroll (lets users enroll their devices)
• require-trusted-device (meant as an example/starting point for enforcement)

[codingllama]

As created in the server:

kind: role
metadata:
  description: Administer trusted devices
  id: 1692725645911361000
  labels:
    teleport.internal/resource-type: preset
  name: device-admin
spec:
  allow:
    rules:
    - resources:
      - device
      verbs:
      - list
      - create
      - read
      - update
      - delete
      - create_enroll_token
      - enroll
  deny: {}
  options:
    cert_format: standard
    create_db_user: false
    create_desktop_user: false
    desktop_clipboard: true
    desktop_directory_sharing: true
    enhanced_recording:
    - command
    - network
    forward_agent: false
    idp:
      saml:
        enabled: true
    max_session_ttl: 30h0m0s
    pin_source_ip: false
    port_forwarding: true
    record_session:
      default: best_effort
      desktop: true
    ssh_file_copy: true
version: v6

kind: role
metadata:
  description: Enroll trusted devices
  id: 1692367644874884000
  name: device-enroll
spec:
  allow:
    rules:
    - resources:
      - device
      verbs:
      - enroll
  deny: {}
  options:
    cert_format: standard
    create_db_user: false
    create_desktop_user: false
    desktop_clipboard: true
    desktop_directory_sharing: true
    enhanced_recording:
    - command
    - network
    forward_agent: false
    idp:
      saml:
        enabled: true
    max_session_ttl: 30h0m0s
    pin_source_ip: false
    port_forwarding: true
    record_session:
      default: best_effort
      desktop: true
    ssh_file_copy: true
version: v6

kind: role
metadata:
  description: Require trusted device to access resources
  id: 1692725645922416000
  labels:
    teleport.internal/resource-type: preset
  name: require-trusted-device
spec:
  allow:
    db_labels:
      '*': '*'
    db_names:
    - '*'
    db_users:
    - '*'
    kubernetes_groups:
    - '{{internal.kubernetes_groups}}'
    - system:masters
    - developers
    - viewers
    kubernetes_labels:
      '*': '*'
    logins:
    - '{{internal.logins}}'
    node_labels:
      '*': '*'
  deny: {}
  options:
    cert_format: standard
    create_db_user: false
    create_desktop_user: false
    desktop_clipboard: true
    desktop_directory_sharing: true
    device_trust_mode: required
    enhanced_recording:
    - command
    - network
    forward_agent: false
    idp:
      saml:
        enabled: true
    max_session_ttl: 30h0m0s
    pin_source_ip: false
    port_forwarding: true
    record_session:
      default: best_effort
      desktop: true
    ssh_file_copy: true
version: v6

[codingllama]

FYI @sshahcodes.

[codingllama]

Tests should be good now, sorry for the delay.

[public-teleport-github-review-bot]

@codingllama See the table below for backport results.

Branch	Result
branch/v13	Create PR