Refactor GenerateUserCerts to create App Sessions

[Joerger]

Implement the changes to GenerateUserCerts described in RFD 169

#### `rpc GenerateUserCerts`

Currently, `rpc CreateAppSession` is used by direct clients to create an App
Session, retrieve it's session ID, and request local app certs linked to the
session ID. In order for direct clients to mark both the App Session cert and
local app cert as MFA verified, the user would need to perform two MFA checks
and two roundtrips.

This should be avoided by allowing clients to call `rpc GenerateUserCerts` to
generate both the local app cert and App Session with a single MFA response.
The client only needs the local app cert after all.

Backwards compatibility between v16 clients and v15 auth servers is handled through a best-effort version check to determine whether the client should create an app session separately. This replaces one roundtrip with another (Ping) but can be removed in v17.

Based off #39742

[github-actions]

The PR changelog entry failed validation: Changelog entry not found in the PR body. Please add a "no-changelog" label to the PR, or changelog lines starting with changelog: followed by the changelog entries for the PR.

[github-actions]

The PR changelog entry failed validation: Changelog entry not found in the PR body. Please add a "no-changelog" label to the PR, or changelog lines starting with changelog: followed by the changelog entries for the PR.

[Joerger]

@zmb3 @strideynet friendly ping to review

[strideynet]

Apologies - got through most of reviewing this and forgot to finish my review. Looks glad - I'm glad this is a single RPC now.