[teleport-update] Add support for tbot Managed Updates

[sclevine]

This PR builds on #55499 and #60477 to add support for tbot Managed Updates to teleport-update, following the same pattern as for teleport. This means that teleport-update will:

1. Create a systemd service for tbot
2. Restart tbot after updates
3. Monitor tbot for various failures that might occur during the update process
4. Revert tbot when failures are detected

Notably, the new functionality does not interfere with any existing tbot services or deployments.

Similar to teleport/teleport.yaml, configuration defaults such as the proxy address may be pulled from tbot.yaml so that tbot-only installations can be converted to Managed Updates with minimal setup.

Avoiding interference with existing services:

If no tbot.service is present on the system already, teleport-update will create one that is unstarted and disabled. Users are prompted to configure tbot and then enable and start the service if tbot functionality is desired.

If tbot.service exists, teleport-update will only update or otherwise manage it if it contains the # teleport-update (version) header.

The --overwrite flag may be used to overwrite any existing binaries or services, including tbot.service.

Install suffix:

As with teleport, multiple independently updated installations (containing teleport, tbot, and other binaries) may be created by passing --install-suffix.

Systemd configuration overrides:

Systemd service fields such as User and Group can be set persistently using systemd drop-ins, which are created automatically by the systemctl edit command.

Bot tracking:

Unlike Teleport agents, bots do not have persistent connections and cannot be tracked during upgrades. The design in this PR works around this implementation in several ways:

1. Bot-only installations are always updated when their group is scheduled to upgrade, with no backpressure or tracking. This behavior is identical to other agentless installations that do not provide a tracking UUID to auth.
2. If a bot is installed alongside a running Teleport agent, and the bot fails /readyz checks, both the agent and bot are reverted, and backpressure / canary functionality applies as expected.

Note that a failed /readyz check will revert the bot back to the previously installed version in all cases.

Note that tbot does not support soft reloads, so Managed Updates will cause tbot to restart while dropping connections. This is mitigated by Managed Updates scheduling, which allows users to control exactly when tbot installations are updated (separately from agents, if desired).

(apologies for typo in branch name -- github does not allow changing source branch names)

changelog: add support for tbot to teleport-update

RFD: #47126
Goal (internal): https://github.com/gravitational/cloud/issues/14225

[sclevine]

@strideynet let me know if I should adjust reviewers

[strideynet]

Looks good from the MWI side - I haven't looked too deeply into the nuts and bolts of the autoupdate agent itself.

[boxofrad]

Great job!