Rework SSH Key param in instance create to be safer/more explicit

There were extensive conversations in #4764 about how to handle the default value of ssh_public_keys in instance create. The behavior implemented in #4764 is that during instance create if a user doesn't provide a value for ssh_public_keys then all their keys are transferred over (like the previous behavior). If they do provide a vec of keys, only those keys are transferred. If they provide an empty vec no keys are transferred.

There are many things to consider here. The security implications of implicitly transferring keys when that may not be the intended behavior, the user experience of requiring this field vs having it optional, the expected default behavior customers have for this functionality, etc.

We need to do some product discovery on what the proper solution is here and implement that for the next release.

Please see this thread for more context: https://github.com/oxidecomputer/omicron/pull/4764#discussion_r1467129836

Start by reading the discussion in issue #4764 and the linked pull request thread, especially the referenced discussion. Use that context to determine the intended default and explicit-value behavior for ssh_public_keys, then identify the instance-create API entry point. Done means a decided product behavior is implemented and verified for omitted, populated, and empty key lists before the next release.