remote-desktop module should complete the setup process on behalf of the user

[proppy]

Describe the feature request

The remote-desktop module currently require the user to use https://remotedesktop.google.com/ in order to copy paste a chromoting setup command snippet in ssh session.

This is required because an access code needs to be negociated and passed to the chrome-remote-desktop/start-host command in order to complete the authorization flow.

It would be nice if instead this access token could be negociated before deployment, or interactively the chrome-remote-desktop startup sequence, without requiring the user to ssh in the instance.

[proppy]

Looking at the chrome inspector during https://remotedesktop.google.com/ setup, it seems the following scopes could are negociated, thru a regular oauth 2.0 server flow:

• https://www.googleapis.com/auth/chromoting.directory
• https://www.googleapis.com/auth/userinfo.email

But according to https://groups.google.com/a/chromium.org/g/chromium-dev/c/v9BNawrY-Xk/m/fx9y00QJAgAJ and https://groups.google.com/a/chromium.org/g/chromium-dev/c/v9BNawrY-Xk/m/fx9y00QJAgAJ, I'm unclear if it would be possible to rebuild the chromoting host tooling against a different client-id/client-secret provisionned during deployment.

[proppy]

Alternatively we could ask the user to perform the step ahead of the deployment, and pass the resulting code= parameter showing up in the chromoting setup command snippet as a var of the terraform recipe.

[proppy]

/cc @nick-stroud

[proppy]

@cboneti mentioned that we could use https://github.com/GoogleCloudPlatform/hpc-toolkit/blob/main/community/modules/remote-desktop/chrome-remote-desktop/README.md#input_startup_script for this, but that we also need to set or generate the pin.