Connect My Computer: Derive agent label from username in main process

[ravicious]

When Connect sets up a Connect My Computer agent, it must execute teleport node configure with the arg --labels=teleport.dev/connect-my-computer/owner=<username>. The previous version would pass the labels like this:

1. The renderer calls tshd (CreateConnectMyComputerNodeToken).
2. tshd returns labels to the renderer (CreateConnectMyComputerNodeTokenResponse).
3. The renderer passes the labels verbatim to the main process.
4. The main process executes teleport node configure with the labels.

This PR makes it so that tshd returns no labels and instead the renderer passes just the username to the main process and the main process derives the agent label from that username.

The original flow was implemented so that the name of the label, teleport.dev/connect-my-computer/owner, is not hardcoded in the JS code and instead is taken directly from the Go code.

However, soon we'll have to hardcode a label in JS anyway. In order to implement polling for the Discover flow, I'll have to pass an extra hidden label anyway. The Go code won't even need to know about this label as it'll be shared exclusively between the Web UI and Connect. I'm going to create a constants.go equivalent in the JS code that's going to live in the shared package to accomplish that.

On top of that, the IPC message sent from the renderer to the main process which creates a config file accepts arbitrary labels, so it technically has a greater attack surface than an IPC message which does not implement. If an attacker compromises the renderer process, they'll be able to create nodes with arbitrary labels. The new implementation does not prevent that, you can still pass a username like alice,foo=bar which will result in the node also getting the foo=bar label. But at least the node will always have teleport.dev/connect-my-computer/owner set to some kind of value.

---

To completely get rid of the problem with that "injection" attack, we'd need to read the username from within the main process. However, currently the main process has no access to information from tshd. For the same reason, the empty state in Connect is not able to link to the Web UI.

[ravicious]

As I wrote in the description, this is just temporary and the next commit will move this and another label to a better location. I just didn't want to spend time on thinking about it upfront since coming up with that new location wasn't needed for this particular PR.

[public-teleport-github-review-bot]

@ravicious See the table below for backport results.

Branch	Result
branch/v14	Failed