Allow the user of identity templates in secret/ssh roles default_user field

[ianferguson]

Is your feature request related to a problem? Please describe.

We would like to configure an ssh role that issues certificates to entities based on their name by default,

i.e. if we have an SSH role configured (using the Vault SSH Role Terraform resource for the sake of example):

resource "vault_ssh_secret_backend_role" "self" {
  backend = vault_mount.ssh_client.path
  name    = "self"
  key_type                = "ca"
  allowed_users           = "{{identity.entity.name}}"
  allowed_users_template  = "true"
}

Currently they (or the tooling running on their behalf) need to make a call the equivalent of:

vault write ssh/sign/self public_key=@id_rsa.pub valid_principals=ianferguson

in order to get a certificate based on their current entity name, in effect requiring the caller to know their entity name and provide it, even though we would like to default to using the entity name if no valid_principal field is provided.

Describe the solution you'd like
Ideally, identity attribute templating could be supported for the default_user field the same way it is currently supported for the allowed_users field

This would allow us to configure out backend role like this:

resource "vault_ssh_secret_backend_role" "self" {
  backend = vault_mount.ssh_client.path
  name    = "self"
  key_type                = "ca"
  default_user  = "{{identity.entity.name}}"
  default_user_template = "true"
  allowed_users           = "{{identity.entity.name}}"
  allowed_users_template  = "true"
}

and then have our client side tooling do the equivalent of:

vault write ssh/sign/self public_key=@id_rsa.pub

and receive back an SSH certificate with the entity's name as a principal without needing to do additional network hops to look up the current entity name or guessing configuration in the request parameters

Describe alternatives you've considered

• guessing the user's entity name from the $USER in their shell (this is not always a 1:1 match or correct)
• looking up the current entity's name with a combination of vault token lookup+vault read entity/id/..... calls. This adds ~2+ additional api calls to Vault, and requires all entity's to have permission to read entity information from the identity backend, which is less ideal

Additional context

This is (tangentially) related to #10946, in that #10946 requires templating support, but this is ultimately only a narrow subset of what the user's in #10946 would like

Pull request implementing this can be found here: #16351