use active db cert principals when available

[GavinFrazar]

fixes #31147 and #30901

[GavinFrazar]

@greedy52 @smallinsky I think I need to refactor this code to be less complicated, although it's hard when we have sparse test coverage for tsh db connect and lots of backwards compatibility to maintain. So to keep it simple to review and merge for the test plan, I've just added the code needed to fix the regression and tested manually.

I think it would be worthwhile to add a db cmd override for testing tsh db connect scenarios comprehensively in CI without the db cli binaries available, so I'll work on a separate PR for that as well.

That tsh db connect ux change keeps coming back to haunt me 😅 I actually tested this exact scenario before, but because I had setup only one allowed db user/name for my user, tsh db connect mydb was choosing those by default and made it seem like the prior behavior was still working 🤦

[public-teleport-github-review-bot]

@GavinFrazar See the table below for backport results.

Branch	Result
branch/v13	Failed
branch/v14	Create PR