Allow workloads to receive federated bundles without having to specify them on a per-entry basis

We have received many questions and comments in the past relating to pain around having to specify which workloads federate with which trust domains. Sometimes it is desirable to have trust domains that all workloads implicitly federate with, and it is a use case that SPIRE should support in an effort to reduce management overhead.

That said, I think there are still use cases in which we want to be explicit about this. How do we have our cake and eat it too?

Here are some options I can think of:

• SPIRE Server configurable: SPIRE Server is configured with an option that tells it to give all workloads all federated bundles. Pro: simple Con: broad control with no ability to scope
• Bundle configurable: The federated bundle, or the federation relationship, is flagged as one that is implicitly passed to all workloads. Pro: More flexible Con: slightly more overhead, less clarity on who federates with what

Of the two, my preference is for the 2nd.

With both of these options, we need to figure out the implication on (and behavior of) the federates_with field we have on entries... and relatedly, how the user gets to know which workloads federate with what (e.g. when a user looks at an entry, do we artificially populate federates_with?)