Eliminate ssh proxy requirement for non-ssh workflows

[programmerq]

What

Currently, if a user wants to use teleport for kubernetes access only, the tsh client will still need to communicate with multiple ports. It should be possible for an end-user to have all communicate tunnel over the proxy_service's web_public_addr port only. This is a particularly challenging wrinkle in a higher security environment that wants the kubernetes access feature specifically to only go through an https application firewall, which doesn't support ssh connections going through it.

database access might also benefit from this, but isn't part of this request.

How

Either admin cluster-wide configuration or individual user configuration opt-in to run port 3023 traffic through the web proxy https port, possibly via a websocket. Alternate might be to have tsh kube login and other kube-specific operations skip any port 3023 communication.

Why

Want to get teleport kube access working through an application gateway firewall appliance to be in compliance with the networking environment involved.

Workaround

none

[russjones]

Will be fixed in #5777.