OIDC-backed SSH certificate auth

[rvolosatovs]

For increased security and usability, proposal is to set up an SSH certificate authority and issue certificates after successful OIDC auth.
That means we could manage access to our servers via https://auth.profian.com and issue short-lived SSH keys, which is very relevant, for example, for CI, where a github action could acquire a short-lived, scoped SSH key for a one-time deployment after presenting a valid token.