[vnet] feat: write VNet SSH keys to TELEPORT_HOME

[nklaassen]

This PR is the next step in the implementation of VNet SSH (RFD).

In this PR the VNet service sends its host CA public key to the client application which writes it to ${TELEPORT_HOME}/vnet_known_hosts so that third-party SSH clients can trust it. It then reads or generates ${TELEPORT_HOME}/id_vnet(.pub) which SSH clients should be configured to use for connections to VNet SSH. id_vnet.pub is sent back to the VNet service and trusted for incoming connections from third-party SSH clients. This is as described at https://github.com/gravitational/teleport/blob/master/rfd/0207-vnet-ssh.md#ssh-client-configuration

With this PR in place connections through VNet SSH fully work. The only thing that's needed is manual configuration of the SSH client so that the correct keys are used, an example is included below. In the following PR this configuration will be automatically generated.

$ cat ./connect_dev_vnet_ssh_config
Host *.one.private
  IdentityFile "/Users/nic/Library/Application Support/Electron/tsh/id_vnet"
  GlobalKnownHostsFile "/Users/nic/Library/Application Support/Electron/tsh/vnet_known_hosts"
  UserKnownHostsFile /dev/null
  StrictHostKeyChecking yes
  IdentitiesOnly yes
$ ssh -F ./connect_dev_vnet_ssh_config node-iot.one.private
Nics-MacBook-Pro:~ nic$ date
Wed May 28 12:15:40 PDT 2025
Nics-MacBook-Pro:~ nic$ exit
logout
Connection to node-iot.one.private closed.
$ ssh -F ./connect_dev_vnet_ssh_config two-auth.two-prod.one.private
Nics-MacBook-Pro:~ nic$ logout
Connection to two-auth.two-prod.one.private closed.

Parent PR: #55156
Child PR: #55239

[rosstimothy]

Suggestion: maybe move the constant within the VNetKnownHostsPath function if it's not intended to be consumed outside of the function?