route based on match quality score

[fspmarshall]

Improves the quality of teleport ssh routing by scoring matches, with stronger matches being given priority.

When a user attempts to ssh into a teleport node, the teleport proxy needs to decide what node to route to based on the host value typed in by the user. The proxy does this both by matching the exact literal and, if the user entered a valid hostname, by matching nodes whose IPs match the IPs associated with that hostname. This can lead to unexpected behavior when multiple nodes share the same IP address. Take the following example nodes:

kind: node
metadata:
  name: 3d3fd67b-17de-4491-a0a7-4d42f3f43e6a
spec:
  addr: 1.2.3.4:123
  hostname: node1.example.com
  # ...
version: v2
---
kind: node
metadata:
  name: 2623bd07-e2aa-43c9-9562-fad37a627ffd
spec:
  addr: 1.2.3.4:456
  hostname: node2.example.com
  # ...
version: v2

Given the above, a user running tsh ssh alice@node1.example.com should be unambiguous, but if node1.example.com corresponds to a valid DNS entry, the resolved IPs will make the match ambiguous because node2.example.com shares the same IP.

This PR changes the behavior of route matching to prioritize nodes that match the literal value typed in by the user over indirect/resolved matches when both match kinds are present.

note: this change only affects routing to direct dial and agentless nodes. tunnel nodes continue to only be routable by ID/hostname, which are always considered direct matches.

changelog: fixed spurious ambiguous host errors in ssh routing

[public-teleport-github-review-bot]

@fspmarshall See the table below for backport results.

Branch	Result
branch/v13	Failed
branch/v14	Failed
branch/v15	Create PR