Add signed key constraints to SSH CA

[broamski]

Adds the ability to enforce particular ssh key types and minimum key lengths when using Signed SSH Certificates via the SSH Secret Engine.

e.g.

  "allowed_user_key_specs": {
      "rsa": 4096,
      "ecdsa": 521,
  }

[jefferai]

Maps are super unfriendly for CLI users so this needs to be rethought. Probably it should follow the key_type/key_bits values from the PKI backend.

[vishalnayak]

@broamski

We discussed about this internally and agreed that accepting maps in this case is okay, given that there are 2 other fields that accept map inputs. As Jeff mentioned, it is a pain to work with map inputs in the CLI. However, the docs provide some examples to work with map inputs in CLI (https://www.vaultproject.io/docs/secrets/ssh/signed-ssh-certificates.html).

SignedKeyConstraints is broader in scope for the functionality it is doing. Assuming that it is named so to accommodate newer constraints within itself, it is unclear as of yet how other kinds of constraints look. Hence, we concluded that it is better to rename the field as allowed_user_key_lengths and confine the behavior to just that. Newer constraints, if they show up, can go under respective newer fields.

Currently the values specified impose length limits. We may want to change that to impose exact lengths (by changing >= to =). This way, it is easier to reason about the role specifications and the behavior will be consistent with other knobs.

[hashicorp-cla]

All committers have signed the CLA.

[catsby]

Closing in favor of #6030