puppet: Only include "app_service" section if there are apps.

This works around gravitational/teleport#12256, but also produces config
files that are slightly cleaner.

puppet/zulip_ops/files/teleport_app.yaml

@@ -0,0 +1,3 @@
+app_service:
+  enabled: yes
+  apps:

puppet/zulip_ops/files/teleport_node.yaml

@@ -32,9 +32,3 @@ proxy_service:
   enabled: no
 auth_service:
   enabled: no
-
-# We intentionally end with `app_service` so we can append services under
-# `apps:` via puppet.
-app_service:
-  enabled: yes
-  apps:

puppet/zulip_ops/manifests/teleport/application.pp

@@ -6,6 +6,7 @@ define zulip_ops::teleport::application (
   $description = '',
   $order = '50',
 ) {
+  include zulip_ops::teleport::application_top
   concat::fragment { "teleport_app_${name}":
     target  => '/etc/teleport_node.yaml',
     order   => $order,

puppet/zulip_ops/manifests/teleport/application_top.pp

@@ -0,0 +1,10 @@
+# @summary Enables application support on the node; include once.
+#
+# See https://goteleport.com/docs/application-access/
+class zulip_ops::teleport::application_top {
+  concat::fragment { 'teleport_app':
+    target => '/etc/teleport_node.yaml',
+    order  => '10',
+    source => 'puppet:///modules/zulip_ops/teleport_app.yaml',
+  }
+}