fix racy use of tls configs

[fspmarshall]

Fixes a race condition introduced in #41077.

The client tls config generator was being passed references to the same TLS config instance that would then subsequently be configured to call back into the client TLS config generator to get client configs. This introduced a race because assignment of the GetConfigForClient field happens after the generator has been started:

generator, err := auth.NewClientTLSConfigGenerator(auth.ClientTLSConfigGeneratorConfig{
	TLS:                  tlsConfig, // background goroutine started that here that will read 'tslConfig'
	// ...
})

tlsConfig.GetConfigForClient = generator.GetConfigForClient // write occurs here

The fix for this issue is to clone the root config before passing it to the generator.

[public-teleport-github-review-bot]

@fspmarshall See the table below for backport results.

Branch	Result
branch/v14	Create PR
branch/v15	Create PR