Release 15.2.2

[fheinecke]

• Updated the cluster selector in the UI to now only be visible when more than one cluster is available. #40478
• Fixed accidental passkey "downgrades" to MFA. #40409
• Added tsh proxy kube --exec mode that spawns kube proxy in the background, which re-executes the user shell with the appropriate kubeconfig. #40395
• Made Amazon S3 fields optional when creating or editing AWS OIDC integration on the web UI. #40368
• Fixed a bug that prevented the available logins from being displayed for Windows desktops in leaf clusters that were being accessed via the root cluster web ui. #40367
• Changed Teleport Connect to hide cluster name in the connection list if there is only a single cluster available. #40356
• Fixed invalid session TTL error when creating access request with tsh. #40335
• Added missing discovery AWS matchers fields "Integration" and "KubeAppDiscovery" to the file configuration. #40320
• Added automatic role access requests. #40285
• Redesigned the login UI. #40272
• Added friendly role names for Okta sourced roles. These will be displayed in access list and access request pages in the UI. #40260
• Added Teleport Machine ID Workload Identity support for legacy systems which are not able to parse DNS SANs, and which are not SPIFFE aware. #40180