Turn off end-user auth capability for macos (#37151)

<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #37134, resolves #37127 

# Details

This PR turns off Orbit's end-user authentication features for macOS
(leaving them in place for Windows and Linux). macOS has its own
end-user auth flows (either through ADE or through the /enroll
endpoint), and the one put in place for Windows/Linux was interfering
with those. It would be good to get this properly sorted out so that all
devices are gated at the same point (currently manually-enrolled macOS
devices enroll to Fleet prior to end-user auth, rather than after) but
we need to unblock enrollment for macs in the meantime!

# Checklist for submitter

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [ ] QA'd all new/changed functionality manually
   - [X] mac
   - [x] linux
   - [x] windows

## fleetd/orbit/Fleet Desktop

- [X] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [X] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [x] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))

---------

Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>

orbit/changes/37134-fix-issue-with-end-user-auth-on-macos

@@ -0,0 +1 @@
+- Fixed an issue where macOS devices would fail to enroll when end-user authentication was configured.

server/fleet/capabilities.go

@@ -2,6 +2,7 @@ package fleet
 
 import (
 	"os"
+	"runtime"
 	"strings"
 	"sync"
 )
@@ -121,11 +122,15 @@ func GetServerDeviceCapabilities() CapabilityMap {
 }
 
 func GetOrbitClientCapabilities() CapabilityMap {
-	return CapabilityMap{
+	capabilities := CapabilityMap{
 		CapabilityEscrowBuddy:     {},
 		CapabilitySetupExperience: {},
-		CapabilityEndUserAuth:     {},
 	}
+	// On non-macOS systems, include end user auth capability.
+	if runtime.GOOS != "darwin" {
+		capabilities[CapabilityEndUserAuth] = struct{}{}
+	}
+	return capabilities
 }
 
 // CapabilitiesHeader is the header name used to communicate the capabilities.

server/service/orbit.go

@@ -203,7 +203,8 @@ func (svc *Service) EnrollOrbit(ctx context.Context, hostInfo fleet.OrbitHostInf
 			if !ok {
 				level.Error(svc.logger).Log("msg", "!!! ERR_ALLOWING_UNAUTHENTICATED: host is not authenticated, but fleet could not determine whether orbit supports end-user authentication. proceeding with enrollment. !!! ", "host_uuid", hostInfo.HardwareUUID)
 			} else if !mp.Has(fleet.CapabilityEndUserAuth) {
-				level.Error(svc.logger).Log("msg", "!!! ERR_ALLOWING_UNAUTHENTICATED: host is not authenticated, but connected with an orbit version that does not support end user authentication. proceeding with enrollment. !!! ", "host_uuid", hostInfo.HardwareUUID)
+				// Quieting this error until https://github.com/fleetdm/fleet/issues/37134 has a proper fix.
+				level.Debug(svc.logger).Log("msg", "!!! ERR_ALLOWING_UNAUTHENTICATED: host is not authenticated, but connected with an orbit version that does not support end user authentication. proceeding with enrollment. !!! ", "host_uuid", hostInfo.HardwareUUID)
 			} else {
 				// Otherwise report the unauthenticated host and let Orbit handle it (e.g. by prompting the user to authenticate).
 				return "", fleet.NewOrbitIDPAuthRequiredError()