Add access_as: user support for web terminal

Proposal

Allow user impersonation as part of the web-terminal. Have an endpoint that UI calls to set everything up in the cluster. The endpoint returns 200 when objects have been created (shouldn't take a long time). UI then polls for pod to come up (via kas proxy) and become ready. Then UI connects to it, etc. What rails does here is provisions a new PAT (with e.g. 2h expiration since our sessions cannot take longer anyway), talks to kas (via a new private API endpoint via gRPC) to provision the manifests rails prepared. kas applies them to the cluster.