Add RBAC proxy to metrics

[saschagrunert]

What type of PR is this?

/kind feature

What this PR does / why we need it:

We now use the kube-rbac-proxy to provide two metrics endpoints. Those
get exposed through the metrics-spod and metrics-controller-runtime
services, serving an authorized self-signed TLS connection.

To be able to retrieve the metrics, it is now required to deploy a
ClusterRole and ClusterRoleBinding for a ServiceAccount. For
example:

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: spo-metrics-client
rules:
- nonResourceURLs:
  - /metrics
  verbs:
  - get
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: spo-metrics-client
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: spo-metrics-client
subjects:
- kind: ServiceAccount
  name: default
  namespace: security-profiles-operator

The above example is also part of the default deployment, and can be
tested via kubectl run within the security-profiles-operator
namespace by running:

> kubectl run --rm -it pod --image=alpine -- sh -c \
    'apk update && apk add bash curl &&
     curl -vsk -H "Authorization: Bearer `cat /var/run/secrets/kubernetes.io/serviceaccount/token`"
     https://metrics-spod/metrics'
…
*   Trying 10.0.0.222:443...
* Connected to metrics-spod (10.0.0.222) port 443 (#0)
…
> authorization: Bearer xxx
>
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* Connection state changed (MAX_CONCURRENT_STREAMS == 250)!
< HTTP/2 200
< content-type: text/plain; version=0.0.4; charset=utf-8
< date: Wed, 28 Apr 2021 12:00:46 GMT
…
security_profiles_operator_seccomp_profile{operation="update"} 1

Documentation and e2e testing will follow in further patches.

Which issue(s) this PR fixes:

Refers to #422

Does this PR have test?

None

Special notes for your reviewer:

None

Does this PR introduce a user-facing change?

Deploying kube-rbac-proxy sidecar in SPOD for exposing metrics via the new `metrics-spod` and `metrics-controller-runtime` services.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: saschagrunert

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [saschagrunert]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[JAORMX]

the rbac-proxy isn't using TLS, is it?

[saschagrunert]

the rbac-proxy isn't using TLS, is it?

It is using a self-signed one right now and we also can provide an external one.

[saschagrunert]

/retest

[JAORMX]

/lgtm