🌱 pkg/authorization: add delegation reason in audit

[s-urbaniak]

Summary

This is scavenging DelegateAuthorization from #2089 to have delegation resons included in the kcp audit log.

Example for delegated authorization:

    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "access granted",
    "bootstrap.authorization.kcp.dev/decision": "Allowed",
    "bootstrap.authorization.kcp.dev/reason": "bootstrap policy: RBAC: allowed by ClusterRoleBinding \"system:kcp:clusterworkspace:admin\" of ClusterRole \"cluster-admin\" to Group \"system:kcp:clusterworkspace:admin\"",
    "content.authorization.kcp.dev/decision": "Allowed",
    "content.authorization.kcp.dev/reason": "delegating due to \"root:e2e-org-b7zvn\" content policy: : systemcrd.authorization.kcp.dev: access granted",
    "maxpermissionpolicy.authorization.kcp.dev/decision": "Allowed",
    "maxpermissionpolicy.authorization.kcp.dev/reason": "delegating due to unbound resource: bootstrap.authorization.kcp.dev: access granted",
    "systemcrd.authorization.kcp.dev/decision": "Allowed",
    "systemcrd.authorization.kcp.dev/reason": "delegating due to no system CRD violation: maxpermissionpolicy.authorization.kcp.dev: access granted",
    "tenancy.kcp.dev/workspace": "root:e2e-org-b7zvn:provider-a",
    "toplevel.authorization.kcp.dev/decision": "Allowed",
    "toplevel.authorization.kcp.dev/reason": "delegating due to root workspace policy for \"e2e-org-b7zvn\": RBAC: allowed by ClusterRoleBinding \"system:admin:system:kcp:clusterworkspace:admin\" of ClusterRole \"cluster-admin\" to Group \"system:kcp:clusterworkspace:admin\": content.authorization.kcp.dev: access granted"

[s-urbaniak]

/retest

[stevekuznetsov]

/lgtm
/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: stevekuznetsov

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [stevekuznetsov]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment