[vnet][5] app proxying

[nklaassen]

This is the sixth in a series of PRs implementing Teleport VNet RFD. parent

This PR completes an MVP tsh vnet implementation - with this PR connections are now forwarded all the way to the Teleport app and VNet is actually usable.

│Nics-MacBook-Pro:teleport nic$ nc -v netcat.one.private 123
│Connection to netcat.one.private port 123 [tcp/ntp] succeeded!
│Hello
│world!
│
├──────────────────────────────────────────────────────────────
│Nics-MacBook-Pro:teleport nic$ nc -lkv 127.0.0.1 12345
│Hello
│world!
│

All teleport clients are cached, I moved the clientcache out of lib/teleterm to share it with Connect. App certificates are automatically reissued on expiry, with a relogin to the cluster if necessary. Per-session MFA is supported. Cached cluster clients will be evicted after a relogin.

This includes the implementation for tsh vnet, with a goal of making it very easy to implement in Connect as well, the AppProvider interface is mostly modelled around the APIs available in Connect and what is already does for app gateways.

lib/vnet/vnet_test.go exercises the app resolver and alpn dialing, but it does not exercise any of the tsh code, I'll be adding integration tests for that later.

[Joerger]

Just left a couple comments around the MFA changes.

[public-teleport-github-review-bot]

@nklaassen See the table below for backport results.

Branch	Result
branch/v16	Create PR