[client] Profile ownership console user tofu (#7529)

* Add consoleuser and stamp default profile on known username in migration

* Refactor consoleuser to verify Id, fix seats on linux and default stamp

* Add default profile claim

* Add disable auto-claim of default profile and always fail close

* Add disable auto-claim flag to migration

* Adding timeout to console user on Linux and close library load on darwin

* Fixed failed close test

* Close both Dlopen for darwin

* Replace RegisterFunc with purego.Dlsym to avoid possible panic

* Fix freebsd tty enumeration

* Fix active profile migration logic and add test

* Log defaultClaimDisabled error once

* Guard against panicking console user lookup.

* Fix merge conflict

* Fix broken tests

client/internal/ipcauth/consoleuser_windows.go

@@ -0,0 +1,40 @@
+package ipcauth
+
+import (
+	"golang.org/x/sys/windows"
+)
+
+// isConsoleUser reports whether id is the user logged into the active Windows
+// console session.
+//
+// Returns false when there is no active console session, the session has no
+// logged-in user, or any lookup fails.
+func isConsoleUser(id Identity) bool {
+	// A caller with no SID is not a Windows principal and has nothing to
+	// compare against the console session's token.
+	if !id.IsWindows() {
+		return false
+	}
+
+	sessionID := windows.WTSGetActiveConsoleSessionId()
+	if sessionID == 0xFFFFFFFF {
+		return false
+	}
+
+	var token windows.Token
+	if err := windows.WTSQueryUserToken(sessionID, &token); err != nil {
+		return false
+	}
+	defer token.Close()
+
+	console, err := identityFromToken(token)
+	if err != nil {
+		return false
+	}
+
+	// The console session's token and the caller's token carry the same SID for
+	// the same account, so the SID is what the two identities share. Elevation
+	// is deliberately not compared: whether the caller's shell is elevated says
+	// nothing about who is sitting at the console.
+	return console.SID != "" && console.SID == id.SID
+}