Auth: Fine-grained access control for TLS clients

[markylaing]

This PR adds:

• The ability to create TLS identities via lxc auth identity create [<remote>:]tls/<name> [<path_to_cert_file>]. If a file is provided, the certificate is sent as a base64 encoded, PEM encoded certificate in the request body. If a file is not provided, an identity of type Client certificate (pending) is created, whose identifier is a UUID. The pending client certificate identity works like a certificate add operation - it's metadata contains a secret and an expiry time.
• The ability for untrusted clients to update their pending client certificate to a Client certificate, with a valid token.
• Updates to lxd remote add to handle these cases.
• The ability to delete TLS and OIDC identities.
• Restrictions to /1.0/certificates so that the API does not show the new TLS identity type.
• The ability to add these new TLS identities to groups.

Here are some examples:

$ lxc auth group create my-group
Group my-group created
$ lxc auth group permission add my-group project default operator
$ lxc auth identity create tls/jane-doe
eyJjbGllbnRfbmFtZSI6ImphbmUtZG9lIiwiZmluZ2VycHJpbnQiOiI1MGYxZWUwYTUxYjRmNzQ0MDcyODAwNTJiMGQ5YzM3MzFkNGIzNjE2ZDE0ZWYwMjMzOTNhZjAzMGRmYzEyMjdhIiwiYWRkcmVzc2VzIjpbIjEyNy4wLjAuMTo4NDQzIl0sInNlY3JldCI6ImMxNjgzYzljYmNlOThhMmZjOTk3MmQwYWNhZTI1MDg5NTU1OWM5YjVkMmZhZDc5MDU5OWY2NTQ3OGYwMTRiMTkiLCJleHBpcmVzX2F0IjoiMDAwMS0wMS0wMVQwMDowMDowMFoiLCJpZGVudGl0eV90eXBlIjoiQ2xpZW50IGNlcnRpZmljYXRlIn0=
$ lxc remote add tls eyJjbGllbnRfbmFtZSI6ImphbmUtZG9lIiwiZmluZ2VycHJpbnQiOiI1MGYxZWUwYTUxYjRmNzQ0MDcyODAwNTJiMGQ5YzM3MzFkNGIzNjE2ZDE0ZWYwMjMzOTNhZjAzMGRmYzEyMjdhIiwiYWRkcmVzc2VzIjpbIjEyNy4wLjAuMTo4NDQzIl0sInNlY3JldCI6ImMxNjgzYzljYmNlOThhMmZjOTk3MmQwYWNhZTI1MDg5NTU1OWM5YjVkMmZhZDc5MDU5OWY2NTQ3OGYwMTRiMTkiLCJleHBpcmVzX2F0IjoiMDAwMS0wMS0wMVQwMDowMDowMFoiLCJpZGVudGl0eV90eXBlIjoiQ2xpZW50IGNlcnRpZmljYXRlIn0=
$ lxc auth identity info tls:
authentication_method: tls
type: Client certificate
id: 1a44a4e3c4ec4613ddb1ac383b07efb3a1627d618f078189f16c0d3d737f41e0
name: jane-doe
groups: []
metadata:
  certificate: |
    -----BEGIN CERTIFICATE-----
    MIIBtjCCATygAwIBAgIQEV92p1vA4XDQyc4kL7NEhjAKBggqhkjOPQQDAzAjMQww
    CgYDVQQKEwNMWEQxEzARBgNVBAMMCm1hcmtAUlVCSVgwHhcNMjQwNzEwMDcxNTMy
    WhcNMzQwNzA4MDcxNTMyWjAjMQwwCgYDVQQKEwNMWEQxEzARBgNVBAMMCm1hcmtA
    UlVCSVgwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAARNj0210EtFuNYPGHnxm4/RwUH4
    qKRn3+N8FBq+Ovk5y1ltQQFlt+484K2YBkCfIFtW5zogyRKDdih2yPLYIevSglpS
    XaHcwqNVfle5VyDNjSOIZJgh/4tu+6qJ2eTIjpejNTAzMA4GA1UdDwEB/wQEAwIF
    oDATBgNVHSUEDDAKBggrBgEFBQcDAjAMBgNVHRMBAf8EAjAAMAoGCCqGSM49BAMD
    A2gAMGUCMQCaybZKv5IsWJBm8IG4ovZYrmr6qXWFqHFd1vlv2jCHw5TNgN153KH7
    QJ2rsF9qEDsCMEKgALok7EsW6kWmrVmDm2p6u625u6Pp5CsYzOLo9vemmFfhgZzn
    g3EPW18D+PUd+w==
    -----END CERTIFICATE-----
effective_groups: []
effective_permissions: []
$ lxc auth identity group add tls/jane-doe my-group
$ lxc project list tls:
+-------------------+--------+----------+-----------------+-----------------+----------+---------------+---------------------+---------+
|       NAME        | IMAGES | PROFILES | STORAGE VOLUMES | STORAGE BUCKETS | NETWORKS | NETWORK ZONES |     DESCRIPTION     | USED BY |
+-------------------+--------+----------+-----------------+-----------------+----------+---------------+---------------------+---------+
| default (current) | YES    | YES      | YES             | YES             | YES      | YES           | Default LXD project | 8       |
+-------------------+--------+----------+-----------------+-----------------+----------+---------------+---------------------+---------+
$ lxc project create tls:foo
Error: Forbidden
$ lxc auth identity list
+-----------------------+--------------------+----------+------------------------------------------------------------------+----------+
| AUTHENTICATION METHOD |        TYPE        |   NAME   |                            IDENTIFIER                            |  GROUPS  |
+-----------------------+--------------------+----------+------------------------------------------------------------------+----------+
| tls                   | Client certificate | jane-doe | 1a44a4e3c4ec4613ddb1ac383b07efb3a1627d618f078189f16c0d3d737f41e0 | my-group |
+-----------------------+--------------------+----------+------------------------------------------------------------------+----------+
$ lxc auth identity create tls/foo
eyJjbGllbnRfbmFtZSI6ImZvbyIsImZpbmdlcnByaW50IjoiNTBmMWVlMGE1MWI0Zjc0NDA3MjgwMDUyYjBkOWMzNzMxZDRiMzYxNmQxNGVmMDIzMzkzYWYwMzBkZmMxMjI3YSIsImFkZHJlc3NlcyI6WyIxMjcuMC4wLjE6ODQ0MyJdLCJzZWNyZXQiOiI3ZTA0OTg5MTEzMTY0N2NjZTkwNzQxMjFjZDAzYWNmNTQ5NGVlNjg2ODgyODgyZDkzMTA4MTAwNDhiOGI0MzE1IiwiZXhwaXJlc19hdCI6IjAwMDEtMDEtMDFUMDA6MDA6MDBaIiwiaWRlbnRpdHlfdHlwZSI6IkNsaWVudCBjZXJ0aWZpY2F0ZSJ9
$ lxc auth identity list
+-----------------------+------------------------------+----------+------------------------------------------------------------------+----------+
| AUTHENTICATION METHOD |             TYPE             |   NAME   |                            IDENTIFIER                            |  GROUPS  |
+-----------------------+------------------------------+----------+------------------------------------------------------------------+----------+
| tls                   | Client certificate           | jane-doe | 1a44a4e3c4ec4613ddb1ac383b07efb3a1627d618f078189f16c0d3d737f41e0 | my-group |
+-----------------------+------------------------------+----------+------------------------------------------------------------------+----------+
| tls                   | Client certificate (pending) | foo      | 3bec59ec-40f8-457c-9d24-5dd9616ea0fe                             |          |
+-----------------------+------------------------------+----------+------------------------------------------------------------------+----------+
$ lxc config trust list
+------+------+-------------+-------------+------------+-------------+
| TYPE | NAME | COMMON NAME | FINGERPRINT | ISSUE DATE | EXPIRY DATE |
+------+------+-------------+-------------+------------+-------------+

Closes #13149

[github-actions]

Heads up @mionaalex - the "Documentation" label was applied to this issue.