Support Azure CLI Access on AKS with workload identity

[greedy52]

Implements #39532:

• Support Azure CLI app access on Azure AKS with Workload ID #39532

changelog: added Azure CLI access support on AKS with Entra Workload ID

Why:
Azure CLI app access is implemented with azidentity.NewManagedIdentityCredential. This works fine for regular VMs, and Azure AKS with Entra pod identity. However, the Entra pod identity is a Preview feature that will be deprecated soon. The Official way to do pod-level identity on AKS is Azure Workload Identity. We also advertise Azure Workload Identity in our own Azure AKS guide.

How it works:

• Workload Identity requires azidentity.NewWorkloadIdentityCredential, plus the client ID of the Azure user-assigned identity in order to be assumed. Multiple workload identities can be assigned to the single service account assigned to the AKS pod.
• On the Pod though, there is only one "default" client ID available to the App service. we assume the "default" client ID/assigned identity is the app-agent identity with Microsoft.ManagedIdentity/userAssignedIdentities/read permission.
• When user sends in requests from tsh, the app agent makes API calls to fetch client IDs for the user-requested identities, then use the fetched client ID for azidentity.NewWorkloadIdentityCredential.

Setup:
(TODO make a proper doc change)

1. AKS
   1. Follow Official Workload ID guide to setup AKS, user identity, service account, OIDC mapping, etc.
   2. IMPORTANT! When following this guide, we create a new app-agent identity say teleport-azure-app-aks-agent for "USER_ASSIGNED_IDENTITY_NAME". Create a role for this identity with Microsoft.ManagedIdentity/userAssignedIdentities/read action permission, and assign it to the role. Note that the client ID for this app-agent will be used for service account's azure.workload.identity/client-id
2. Deploy Teleport App Service with an azure app (cloud: "Azure") and use the service account created in the previous step for this pod in this AKS cluster.
3. For each end-user access user assigned identities
   1. Create a user assigned identity for end-user access, say teleport-user-reader, and grant it relevant permissions.
   2. Repeat the "Establish federated identity credential" from the above guide, but use the end-user identity and assign it to the same service account (e.g: az identity federated-credential create --name federated-teleport-user-reader --identity-name teleport-user-reader --resource-group "${RESOURCE_GROUP}" --issuer "${AKS_OIDC_ISSUER}" --subject system:serviceaccount:"${SERVICE_ACCOUNT_NAMESPACE}":"${SERVICE_ACCOUNT_NAME}" --audience api://AzureADTokenExchange)
   3. Grant this identity to the Teleport role or user traits.
4. Use tsh apps login <azure-on-aks> and tsh az as usual

Testing

• AKS
• Azure VM (for existing "direct" managed identity credential)

[public-teleport-github-review-bot]

@greedy52 See the table below for backport results.

Branch	Result
branch/v15	Failed