Add controller-led worker auth flow (#2413)

This adds an action to the API that allows pulling out an activation
token that can be given to a worker in its config (directly or via env
or file). The worker can pass this along with its normal request in
place of its normal nonce and the server will automatically accept it.

Co-authored-by: Irena Rindos <irenarindos@users.noreply.github.com>

internal/db/schema/migrations/oss/postgres/48/01_worker_auth_activation_token.up.sql

@@ -0,0 +1,30 @@
+begin;
+
+create table worker_auth_server_led_activation_token(
+  worker_id wt_public_id primary key
+    constraint server_worker_fkey
+      references server_worker (public_id)
+        on delete cascade
+        on update cascade,
+  token_id text not null
+    constraint token_id_must_not_be_empty
+      check(length(trim(token_id)) > 0),
+  creation_time_encrypted bytea not null
+    constraint creation_time_encrypted_must_not_be_empty
+      check(length(creation_time_encrypted) > 0),
+  key_id kms_private_id not null
+    constraint kms_data_key_version_fkey
+      references kms_data_key_version (private_id)
+      on delete restrict
+      on update cascade,
+
+  constraint worker_auth_server_led_activation_token_token_id_uq -- only one valid token at a time for a given worker
+    unique(token_id)
+);
+comment on table worker_auth_server_led_activation_token is
+  'worker_auth_server_led_activation_token is a table where each row represents an activation token for a worker. Only one activation token is allowed per worker.';
+
+create trigger immutable_columns before update on worker_auth_server_led_activation_token
+  for each row execute procedure immutable_columns('worker_id', 'token_id', 'creation_time_encrypted');
+
+commit;