Add Ssh cert auth for targets

[Koalab99]

Include implementation of SSH Certificate authentication for targets + tests + user procedure

[theredspoon]

Comparing this against #2397 while reviewing that PR (context: #26, #2400).

On the target leg, this is architecturally the same design as #2397: ephemeral per-connection certificate, target trusts via TrustedUserCAKeys. The two differ in where the CA key lives, and a few things are worth naming directly rather than leaving implicit:

The CA key here is the existing client auth key, unencrypted PKCS#8 PEM, no passphrase, protected only by filesystem permissions. That means the auth key and the fleet-wide signing capability are the same file, one filesystem read gets both. No key_id is set on issued certificates, so unlike #2397, a target's own sshd log doesn't attribute a session to a person. And onboarding is still fully manual TOFU with no rotation or distribution path, the same gap Eugeny flagged in #26 back in June, still true today.

Not raising this to dismiss the work, Eugeny was actively preparing this for merge in April before pausing on it. But given #2397's current momentum and the gaps above, worth asking directly: would you be open to closing this in favor of #2397, with the no-external-dependency case tracked separately as a future pluggable backend, the exact direction you proposed yourself in #26 (#26 (comment))?