app.session.start audit event is not emitted when using Application Access with tsh or tbot

[strideynet]

The app.session.start audit event is intended to be emitted when a user begins an Application Access session. This functions correctly when using the Web UI, but when using tsh or tbot it does not appear. Other audit events, such as those that are emitted for each chunk / request, function correctly.

This is because it is emitted by the handler for POST /v1/webapi/sessions/app in the Proxy Service API. tsh and tbot call the CreateAppSession RPC on the Auth Server directly and do not use this endpoint.

As app.session.start is converted to an analytics event, this also has a knock on affect on our product analytics (app activity using tsh or tbot will not be recorded) for Teleport Cloud.

[strideynet]

I'm curious if we can just move this to be emitted as part of the Auth Server rather than in the Proxy - need to investigate and ensure all fields included in the current audit event could equally be emitted from the Auth Server.

If not, we may want to consider adding some other analytics event (perhaps based on session chunks/requests) in order to properly track Application Access usage in cloud.

[zmb3]

Fixed by #43636