Allow users impersonating database service generate database certs

[r0mant]

This PR fixes the issue with users not being able to produce database certificates using tctl auth sign --format=db with remote proxy: #6937. The effect of this issue is that it is basically impossible to connect self-hosted databases to the Cloud currently.

Note: Here "database certificate" refers to the certificate that cluster admin uses to configure their self-hosted database instance with (signed with Teleport's host CA), not the client certificate issued during tsh db login.

Previously, we would only check for built-in roles Admin and Database which is both inflexible and, arguably, less secure. With this change I introduced a separate db_cert resource kind we're checking for "create" permission on: rather than checking for "create" on db_server as proposed in the linked ticket, I decided that having a separate resource makes more sense and also this is in-line with how host certificates RBAC is checked - which is conceptually similar.

Consequentially, I've updated our default admin and editor user roles and built-in Database role (used by database service agent) to include permission to generate these certificates.

Closes #6937. Needs backport to v6.

[russjones]

Bot.

[r0mant]

@klizhentas I've updated to check for impersonation permissions for builtin system roles instead, as we discussed. Since impersonation requires both users and roles, users wishing to generate db certs would need to add the following permission in their role:

impersonate:
  roles:
  - Db
  users:
  - Db

PTAL.