Make reception of an empty valid principals configurable based on a role flag. (#28466)

* Make reception of an empty valid principals configurable based on a role flag.

Adds allow_empty_principals, which if true allows valid_principals on credential generation calls
to be empty.

* changelog

* Allow empty principals on unrelated unit test

* whitespace

website/content/api-docs/secret/ssh.mdx

@@ -171,6 +171,10 @@ This endpoint creates or updates a named role.
   ~> **Note**: In FIPS 140-2 mode, the following algorithms are not certified
      and thus should not be used: `ed25519`.
 
+- `allow_empty_principals` `(bool: false)` - Allow signing certificates with
+  no valid principals (e.g. any valid principal).  For backwards
+  compatibility only.  The default of false is highly recommended.
+
 - `algorithm_signer` `(string: "default")` - Algorithm to sign keys with. Valid
   values are `ssh-rsa`, `rsa-sha2-256`, `rsa-sha2-512`, or `default`. This
   value may also be left blank to use the signer's default algorithm, and must
@@ -190,6 +194,10 @@ This endpoint creates or updates a named role.
 - `not_before_duration` `(duration: "30s")` – Specifies the duration by which to
   backdate the `ValidAfter` property. Uses [duration format strings](/vault/docs/concepts/duration-format).
 
+- `allow_empty_principals` `(bool: false)` - If true, allows certificates
+  to be issued against all principals.  Highly recommended to use the default of
+  false.
+
 ### Sample payload
 
 ```json
@@ -744,7 +752,8 @@ parameters of the issued certificate can be further customized in this API call.
   set.
 
 - `valid_principals` `(string: "")` – Specifies valid principals, either
-  usernames or hostnames, that the certificate should be signed for.
+  usernames or hostnames, that the certificate should be signed for.  Required
+  unless the role has specified allow_empty_principals.
 
 - `cert_type` `(string: "user")` – Specifies the type of certificate to be
   created; either "user" or "host".
@@ -830,7 +839,8 @@ parameters of the issued certificate can be further customized in this API call.
   set.
 
 - `valid_principals` `(string: "")` – Specifies valid principals, either
-  usernames or hostnames, that the certificate should be signed for.
+  usernames or hostnames, that the certificate should be signed for.  Required
+  unless the role has specified allow_empty_principals.
 
 - `cert_type` `(string: "user")` – Specifies the type of certificate to be
   created; either "user" or "host".
@@ -926,4 +936,4 @@ $ curl \
   "warnings": null,
   "auth": null
 }
-```
+```