Workload ID: Support custom claims in JWT-SVIDs

[boxofrad]

This is a potential option for #52500. I started hacking on it to understand the problem better, and realized I had something that works quite well!

It allows you to add arbitrarily nested claims as an object, and use templating in any of the string fields.

Example configuration:

kind: workload_identity
version: v1
metadata:
  name: my-workload
spec:
  spiffe:
    id: /foo/bar
    jwt:
      extra_claims:
        "simple-string-claim": "{{ join.kubernetes.pod.name }}"
        "something-more-complex":
          foo: "bar"
          baz:
            - true
            - 1234
            - "{{ user.name }}"
            - blah

Resulting JWT claims:

{
  "simple-string-claim": "billing-service",
  "something-more-complex": {
    "foo": "bar"
    "baz": [true, 1234, "robot", "blah"]
  }
}

It's implemented using the protobuf Struct WKT, which is more-or-less a way to represent arbitrary JSON objects as protobuf data, so we don't need to implement any custom marshaling.

changelog: Workload ID: Support for adding custom claims to JWT-SVIDs

[boxofrad]

Temporarily blocked by gravitational/protoc-gen-terraform#52