Beams runs an app_service, configured to look for apps with
the "teleport.internal/beams/app-type" label.
Users should not be able to create apps with this label - we expect
these apps are only created via static beams config or via the
`tsh beams publish` command.
It's safe to block these requests at the RPC layer because beam
apps are written directly to storage and don't go through these
auth RPCs.
Zac Bergquist
fad450b4ea