Workload Identity: Add workload-identity-x509 service to tbot

[strideynet]

Part of: #49986

As per RFD191: #49133

For now, this command is hidden until we remove the feature flag.

version: v2
proxy_server: example.teleport.sh
onboarding:
  join_method: kubernetes
  token: local-workload-id
certificate_ttl: 24h
storage:
  type: directory
  path: /Users/noah/code/gravitational/teleport-scratch/tbot-new-workload-id/storage
services:
  - type: workload-identity-x509
    destination:
      type: directory
      path: /Users/noah/code/gravitational/teleport-scratch/tbot-new-workload-id/svid-out
    workload_identity:
      name: workload-identity
  - type: workload-identity-x509
    destination:
      type: directory
      path: /Users/noah/code/gravitational/teleport-scratch/tbot-new-workload-id/svid-labels-out
    workload_identity:
      labels:
        test: [bar]

Follow up PRs will include the workload-identity-api and workload-identity-jwt services.

[strideynet]

Is --workload-identity-name and --workload-identity-labels too verbose? I was worried that just --name / --labels would be not verbose enough. Perhaps --name-selector / --label-selector ?

[timothyb89]

I'm actually curious about this exact question on #50898. I've so far gone with the unambiguous but way too verbose names following the pattern here, but was strongly considering the much shorter --name and --labels since users can probably infer meaning from context. Maybe there's some additional benefit knowing that e.g. --labels can be reused across certain commands that accept selectors?

[strideynet]

Should the JSON/YAML name of this field reference the "selector" nature of the field - e.g workload_identity_selector or selector ?