Add API to change authentication settings in config file

[webvictim]

Feature Request

Add an API to change the following authentication settings in the Teleport config file:

1. Default authentication type (can be local, github, saml or oidc):

auth_service:
  authentication:
    type: github

2. Two-factor method used (can be off, otp or u2f):

auth_service:
  authentication:
    second_factor: u2f

(for u2f we also probably need to automatically infer the app_id and facets from the proxy_service.public_addr, or provide a way to set these as well):

auth_service:
  authentication:
    second_factor: u2f
    u2f:
      app_id: https://teleport.example.com:3080
      facets:
      - teleport.example.com:3080
      - https://teleport.example.com:3080

3. Whether local auth is allowed or not (can be true or false):

auth_service:
  authentication:
    local_auth: true

Who's it for?

Programmatic users of Teleport

[benarent]

We should also consider #1929 while working on this.

[webvictim]

💯 , multiple U2F keys is a must-have.

[zmb3]

This is obsolete now that we have dynamic configuration for the cluster auth preference.