[v10] Properly handle empty list of role requests (#13456)

[timothyb89]

Backport of #13456 for branch/v10.

---

• Properly handle empty list of role requests

Currently, an empty list of role requests results in an ambiguous
situation: we usually use the presence of role requests to determine
whether or not we'd return impersonated certs or not. An empty list
of role requests returns a fresh set of non-impersonated certs
(possibly renewed if allowed), while a non-empty list of role requests
returns certs with just those roles. However, if a client intends
to request impersonated certs but provides an empty list of role
requests it will instead receive non-impersonated (possibly renewable)
certs with the full permissions of the original user.

This could theoretically result in privilege escalation if a Machine
ID bot: (a) had any worthwhile permissions of its own, which is not
the case unless the bot role was manually modified and (b)
accidentally handed certs off to an attacker.

In practice this bug is fairly difficult to hit: tbot always
auto-fills all requestable roles if they are otherwise unset, and
tctl bots add requires --roles= to be passed. An empty string
here can trigger the bug however it is unlikely a user would pass this
by accident. Moreover, a bot without requestable roles cannot
accomplish much of anything, so this is exceedingly unlikely to
be intended behavior.

Additionally, certificate generation checks help to mitigate the
issue: bots currently lock themselves by accident after the first
renewal when this bug is triggered as they don't explicitly handle
receiving renewable certs when impersonated certs are expected. If an
attacker were to attempt a renewal, the generation counter would
similarly limit access, and as noted previously, the bot role grants
only minimal read-only access anyway.

---

To resolve the issue, this adds a new RoleRequestsOnly flag to
UserCertsRequest that allows clients to unambiguously specify if
they wish to receive a non-impersonated, possibly renewable, cert with
all the original user's roles and permissions, or if they wish to
receive only role-impersonated certs (or an error if roles are empty).
Machine ID passes this flag in all situations where an impersonated
cert is desired.

Additionally, we also now ensure users add at least one role in
CreateBot() (called by tctl bots add) as this is almost certainly
an unintended situation.

Fixes #13411

• Address review feedback, rename flag to UseRoleRequests

• Return a local error if no roles are specified