feat: Disable auto-enroll via environment variable

[codingllama]

Users or remote admins can now set TELEPORT_DEVICE_AUTO_ENROLL_DISABLED=1 to disable auto-enroll in their machine, regardless of cluster setting.

Changelog: Auto-enroll may be locally disabled using the TELEPORT_DEVICE_AUTO_ENROLL_DISABLED=1 environment variable

[codingllama]

This one is a bit experimental, but I think it could help if a customer wants to automatically exclude a certain category of machines from auto-enroll.

[rosstimothy]

This one is a bit experimental

For these kinds of things we've been using TELEPORT_UNSTABLE_FOO

[codingllama]

This one is a bit experimental

For these kinds of things we've been using TELEPORT_UNSTABLE_FOO

It's not experimental in that sense, it was more in that I was still looking for confirmation on whether it would be useful. The answer is "yes" so I think the proposed env var is better.

[rosstimothy]

One of the other reasons the TELEPORT_UNSTABLE prefix has been used is to prevent people from relying on the environment variables longterm. Is this going to be a thing in perpetuity or do you plan on removing this in favor of another mechanism in the future? If the latter I think the TELEPORT_UNSTABLE prefix should be used here.