Add IdentityCenter resources to App

IdentityCenter accounts are exposed to the Teleport UI as applications,
with each app containing the list of AWS permission sets available on
the corresponding account.

This change adds the necessary additions to the App protobuf types
to carry the Identity Center information.

api/proto/teleport/legacy/types/types.proto

@@ -963,6 +963,26 @@ message CORSPolicy {
   repeated string exposed_headers = 6 [(gogoproto.jsontag) = "exposed_headers,omitempty"];
 }
 
+// IdentityCenterPermissionSet defines a permission set that is available on an
+// IdentityCenter account app
+message IdentityCenterPermissionSet {
+  // ARN is the fully-formed ARN of the Permission Set.
+  string ARN = 1 [(gogoproto.jsontag) = "arn,omitempty"];
+
+  // Name is the human-readable name of the Permission Set.
+  string Name = 2 [(gogoproto.jsontag) = "name,omitempty"];
+}
+
+// AppIdentityCenter encapsulates information about an AWS Identity Center
+// account application.
+message AppIdentityCenter {
+  // Account ID is the AWS-assigned ID of the account
+  string AccountID = 1 [(gogoproto.jsontag) = "account_id,omitempty"];
+
+  // PermissionSets lists the available permission sets on the given account
+  repeated IdentityCenterPermissionSet PermissionSets = 2 [(gogoproto.jsontag) = "permission_sets,omitempty"];
+}
+
 // AppSpecV3 is the AppV3 resource spec.
 message AppSpecV3 {
   // URI is the web app endpoint.
@@ -993,6 +1013,9 @@ message AppSpecV3 {
   repeated string RequiredAppNames = 10 [(gogoproto.jsontag) = "required_app_names,omitempty"];
   // CORSPolicy defines the Cross-Origin Resource Sharing settings for the app.
   CORSPolicy CORS = 11 [(gogoproto.jsontag) = "cors,omitempty"];
+  // IdentityCenter encasulates AWS identity-center specific information. Only
+  // valid for Identity Center account apps.
+  AppIdentityCenter IdentityCenter = 12 [(gogoproto.jsontag) = "identity_center,omitempty"];
 }
 
 // AppServerOrSAMLIdPServiceProviderV1 holds either an AppServerV3 or a SAMLIdPServiceProviderV1 resource (never both).