Improvement: Allow specifying valid principals for SSH command CA mode

[rmbrad]

Feature Request:
Currently when specifying CA mode the vault SSH command will use the SSH username as the value for the principals field of the signed user certificate. This precludes the use of the AuthorizedPrincipalsFile SSHD config directive to accept principals that differ from the host user being logged in as.

This can be allowed by adding a valid-principal flag that enables the user to supply the list of valid principals for inclusion in the certificate. When the flag is not specified it can default to using the SSH username.

[rmbrad]

Fixed in #3922