Clean up system role parsing

[zmb3]

Be more consistent in what inputs we accept when referring to system roles, such as in the tctl tokens add call.

Also add missing test coverage for this parser.

Fixes #9752

[smallinsky]

nit: This approach have one main drawback the roleMappings map needs to be updated each time when a new Role is added also with the Check() case

What would you say about something like:

func (r *SystemRole)  Check() error {
    m := make(map[string]struct{})
    for _, v := range roleMappings {
        if v == r {
            return nil
         }
     }
   return trace.BadParameter("role %v is not registered", *r)
} 

so only we care about roleMappings

[zmb3]

Good call, take a look at the latest commit. I like this much better.

[greedy52]

is provision_token a valid input?

[zmb3]

No, it never has been.

We're a little more tolerant and allow _ separators for things that are commonly typed on the command line, like when generating tokens to allow a kube service or windows desktop service to join the cluster.

Since no one ever needs to generate provision tokens via the CLI, I didn't see a need to make provision_token valid.

In fact, after a quick search, it seems RoleProvisionToken is never used. Maybe we should delete it.