GitLab Delegated Joining (#22705)

* Add type for GitLab ProvisionToken

* Add default behaviour for domain

* Add IDTokenClaims for GitLab

* Add gitlab token source and token validator

* Thread GitLab support through auth and tbot packages

* Adjust cluster name fetching in token validator

* Initialize GitLab token validator in auth

* Improve comment on `sub`

* Working GitLab CI delegated joining

* Add additional token rule fields

* Add checking for new configuration fields

* add additional test cases for validation of gitlab config struct

* Add TestAuth_RegisterUsingToken_GitLab

* Add tests for IDTokenSource

* Fix imports

* Add tests for GitLab Token Validator

* Fix some comments that were incomplete

* Add license headers

api/proto/teleport/legacy/types/types.proto

@@ -1134,6 +1134,8 @@ message ProvisionTokenSpecV2 {
   ProvisionTokenSpecV2Kubernetes Kubernetes = 10 [(gogoproto.jsontag) = "kubernetes,omitempty"];
   // Azure allows the configuration of options specific to the "azure" join method.
   ProvisionTokenSpecV2Azure Azure = 11 [(gogoproto.jsontag) = "azure,omitempty"];
+  // GitLab allows the configuration of options specific to the "gitlab" join method.
+  ProvisionTokenSpecV2GitLab GitLab = 12 [(gogoproto.jsontag) = "gitlab,omitempty"];
 }
 
 // ProvisionTokenSpecV2Github contains the GitHub-specific part of the
@@ -1178,6 +1180,47 @@ message ProvisionTokenSpecV2GitHub {
   string EnterpriseServerHost = 2 [(gogoproto.jsontag) = "enterprise_server_host,omitempty"];
 }
 
+// ProvisionTokenSpecV2GitLab contains the GitLab-specific part of the
+// ProvisionTokenSpecV2
+message ProvisionTokenSpecV2GitLab {
+  message Rule {
+    // Sub roughly uniquely identifies the workload. Example:
+    // `project_path:mygroup/my-project:ref_type:branch:ref:main`
+    // project_path:{group}/{project}:ref_type:{type}:ref:{branch_name}
+    string Sub = 1 [(gogoproto.jsontag) = "sub,omitempty"];
+    // Ref allows access to be limited to jobs triggered by a specific git ref.
+    // Ensure this is used in combination with ref_type.
+    string Ref = 2 [(gogoproto.jsontag) = "ref,omitempty"];
+    // RefType allows access to be limited to jobs triggered by a specific git
+    // ref type. Example:
+    // `branch` or `tag`
+    string RefType = 3 [(gogoproto.jsontag) = "ref_type,omitempty"];
+    // NamespacePath is used to limit access to jobs in a group or user's
+    // projects.
+    // Example:
+    // `mygroup`
+    string NamespacePath = 4 [(gogoproto.jsontag) = "namespace_path,omitempty"];
+    // ProjectPath is used to limit access to jobs belonging to an individual
+    // project. Example:
+    // `mygroup/myproject`
+    string ProjectPath = 5 [(gogoproto.jsontag) = "project_path,omitempty"];
+    // PipelineSource limits access by the job pipeline source type.
+    // https://docs.gitlab.com/ee/ci/jobs/job_control.html#common-if-clauses-for-rules
+    // Example: `web`
+    string PipelineSource = 6 [(gogoproto.jsontag) = "pipeline_source,omitempty"];
+    // Environment limits access by the environment the job deploys to
+    // (if one is associated)
+    string Environment = 7 [(gogoproto.jsontag) = "environment,omitempty"];
+  }
+  // Allow is a list of TokenRules, nodes using this token must match one
+  // allow rule to use this token.
+  repeated Rule Allow = 1 [(gogoproto.jsontag) = "allow,omitempty"];
+  // Domain is the domain of your GitLab instance. This will default to
+  // `gitlab.com` - but can be set to the domain of your self-hosted GitLab
+  // e.g `gitlab.example.com`.
+  string Domain = 2 [(gogoproto.jsontag) = "domain,omitempty"];
+}
+
 // ProvisionTokenSpecV2CircleCI contains the CircleCI-specific part of the
 // ProvisionTokenSpecV2
 message ProvisionTokenSpecV2CircleCI {