Add "tsh kube" commands

[awly]

1. tsh kube clusters - lists registered kubernetes clusters
   note: this only includes clusters connected via kubernetes_service

2. tsh kube credentials - returns TLS credentials for a specific kube
   cluster; this is a hidden command used as an exec plugin for kubectl

3. tsh kube login - switches the kubectl context to one of the
   registered clusters; roughly equivalent to kubectl config use-context

When updating kubeconfigs, tsh now uses the exec plugin mode:
https://kubernetes.io/docs/reference/access-authn-authz/authentication/#client-go-credential-plugins
This means that on each kubectl run, kubectl will execute tsh with
special arguments to get the TLS credentials.

Using tsh as exec plugin allows us to put a login prompt when certs
expire. It also lets us lazy-initialize TLS certs for kubernetes
clusters.

Updates #3952
Fixes #3691

As before, sending this out for review before all unit tests are finished. I'll be adding those shortly.

[a-palchikov]

This is introducing a lot of change in the existing client code and adds another task for the function it should not ideally perform. Have you considered adding GetKubeClusterKey as an alternative? It is an aggregation of GetKey with kube cert lookup:

func GetKubeClusterKey(store *FSLocalKeyStore, proxyHost, username, clusterName string) (*Key, error) {
	key, err := store.GetKey(proxyHost, username)
	if err != nil {
		return nil, trace.Wrap(err)
	}
	dirPath, err := store.dirFor(proxyHost, false)
	if err != nil {
		return nil, trace.Wrap(err)
	}
	kubeCerts, err := ReadKubeCerts(dirPath, clusterName)
	if err != nil {
		store.log.Error(err)
		return nil, trace.Wrap(err)
	}
	key.ClusterName = clusterName
	key.KubeTLSCerts = kubeCerts
	return key, nil
}

ReadKubeCerts could be tested separately and GetKubeClusterKey needn't be tested at all since it solely calls into APIs which are tested.

[awly]

Valid point.
Since we'll be storing database and app certs in a similar way, I changed it to use pluggable options.
WDYT?

[a-palchikov]

Well, it is an improvement in that it will isolate the code so it becomes easier to test, yes.
You should consider doing this for other related APIs - e.g. DeleteKey.

[a-palchikov]

Well, it is an improvement in that it will isolate the code so it becomes easier to test, yes.
You should consider doing this for other related APIs - e.g. DeleteKey.

[r0mant]

lgtm with a few comments

[r0mant]

I would consider quoting the flag values, =%q, here and below.

[awly]

These args are passed directly to exec, not to a shell.
Quotes won't be stripped (like they would be with a shell) and tsh will see --kube-cluster as "foo" instead of foo

[r0mant]

Is --insecure flag going to be recognized fine when appended? I've run into some issues with that before, that it had to go right after tsh. I'd consider prepending it instead.

[awly]

it worked fine when I tested, but I can see it being a problem for tsh ssh where it expects flags before arguments