feat: Hardware Key Agent validates known keys

[Joerger]

Changelog: Hardware Key Agent validates known keys by checking active or expired login session.

Changes:

Hardware Key Agent now makes a best effort to validate that a PIV slot is for Teleport by checking an active or expired Teleport login key matching the hardware key in the agent signature request.

If the key is unknown to the agent, e.g. because the agent request is from a Teleport client with a different Teleport Home directory, the agent will instead validate the key by checking the PIV slot certificate.

Context:

As a security constraint, the Hardware Key Agent does not allow signature for PIV slots that do not correspond to a known Teleport PIV key. This is currently done by checking the PIV slot certificate, which should have "teleport" as the subject organization name. This implies that a Teleport client generating the key and cert, or the YubiKey's administrator manually generated the key and cert for Teleport. This allows the Hardware Key Agent to discern whether a PIV slot is intended for Teleport use without any cluster login information, meaning that the Hardware Key Agent can operate with Teleport Connect without any active logins. However, in some administrative environments, the certificate subject name validation is impossible or difficult to comply with, in which case the Hardware Key Agent does need to check for active or expired login sessions.

[backport-bot-workflows]

@Joerger See the table below for backport results.

Branch	Result
branch/v16	Failed
branch/v17	Failed