auth: ensure machines are allowed in when pak change (#2917)

proto/headscale/v1/headscale.proto

@@ -55,6 +55,13 @@ service HeadscaleService {
     };
   }
 
+  rpc DeletePreAuthKey(DeletePreAuthKeyRequest)
+      returns (DeletePreAuthKeyResponse) {
+    option (google.api.http) = {
+      delete : "/api/v1/preauthkey"
+    };
+  }
+
   rpc ListPreAuthKeys(ListPreAuthKeysRequest)
       returns (ListPreAuthKeysResponse) {
     option (google.api.http) = {

proto/headscale/v1/preauthkey.proto

@@ -34,6 +34,13 @@ message ExpirePreAuthKeyRequest {
 
 message ExpirePreAuthKeyResponse {}
 
+message DeletePreAuthKeyRequest {
+  uint64 user = 1;
+  string key = 2;
+}
+
+message DeletePreAuthKeyResponse {}
+
 message ListPreAuthKeysRequest { uint64 user = 1; }
 
 message ListPreAuthKeysResponse { repeated PreAuthKey pre_auth_keys = 1; }