FR: Support workload identity for tsrecorder

### What are you trying to do?

I'm deploying Tailscale SSH Recorder in our Kubernetes cluster without the use of Tailscale Kubernetes Operator, because it looks like an overkill for deploying just one or two pods of SSH recorders. I wanted to utilize workload identity for authentication, because I know that Kubernetes generates OIDC JWT tokens, and that Tailscale now supports them. Unfortunately, I have found no way to pass a client ID and OIDC token to `/tsrecorder`.

### How should we solve this?

Add arguments (and preferably environment variables) for `/tsrecorder` to utilize workload identity for authentication.

### What is the impact of not solving this?

~I will need to create OAuth clients and pass them as secrets through several layers of our infrastructure to get them to production.~ I have to deploy Tailscale Kubernetes Operator just to deploy one pod of Tailscale SSH Recorder, or to manually log it in.

### Anything else?

https://tailscale.com/kb/1246/tailscale-ssh-session-recording
https://tailscale.com/kb/1581/workload-identity-federation