This PR prevents root proxies from impersonating users from different clusters when accessing a leaf cluster.

During authentication, the proxy presents its certificate and sends the impersonation header.

A malicious attacker in possession of the root cluster proxy cert-key pair could bypass the root-leaf cluster permissions boundary by impersonating local users. This PR prevents that and remote proxies can only impersonate users belonging to their cluster.

KubeCSR Flow:
```mermaid
sequenceDiagram
    ROOT PROXY->>+LEAF PROXY: Forward the request identity cert
    LEAF PROXY ->> LEAF AUTH SRV: Sign identity via KubeCSR
    LEAF AUTH SRV -->> LEAF PROXY: Identity cert
    LEAF PROXY ->> LEAF KUBE SERVICE: Forward the request using cert
    LEAF KUBE SERVICE -->> LEAF PROXY: Return response
    LEAF PROXY -->> ROOT PROXY: Return response
```

Impersonation Flow:
```mermaid
sequenceDiagram
    ROOT PROXY->>+LEAF PROXY: Forward the request identity by Impersonating
    LEAF PROXY ->> LEAF KUBE SERVICE: Forward the request identity by Impersonating
    LEAF KUBE SERVICE -->> LEAF PROXY: Return response
    LEAF PROXY -->> ROOT PROXY: Return response
```

Fixes gravitational/teleport-private#968
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>