Add command to request a bound service account token

[liggitt]

What type of PR is this?

/kind feature

What this PR does / why we need it:

Default RBAC policy change:

• Include TokenRequest create permission in the default edit and admin roles. These roles already have full access to service account credentials via secrets, and will be able to get tokens via manually created token secrets in the future, and can create pods that exfiltrate injected tokens. Giving them direct access to tokenrequest is not a practical escalation from their current permissions.

TokenRequest endpoint changes:

• Ensures any name/namespace/uid specified in the token request matches the service account
• Ensures name/namespace/uid is populated in the returned tokenrequest object
• Ensures the tokenrequest passed to validating admission is valid (instead of running in-process validation after calling validation webhooks)
• Populate creationTimestamp in the returned object with the creation time as seen by the server
• Adds a server-side warning if the requested expiration lifetime is shortened by the server

Kubectl changes:

• Adds a command to kubectl to request a bound service account token. This will help ease the transition from scraping generated service account tokens with commands like kubectl get secret "$(kubectl get serviceaccount default -o jsonpath='{.secrets[0].name}')"

xref https://github.com/kubernetes/enhancements/tree/master/keps/sig-auth/2799-reduction-of-secret-based-service-account-token

TODO:

• relocate to kubectl create token
• consider whether we want to warn about not-honored requested spec.expirationSeconds server-side rather than client-side
• think about whether end users with edit or admin roles in a namespace would expect to be able to do this (currently no user-facing roles include serviceaccounts/token permissions)
• add tests

Does this PR introduce a user-facing change?

`kubectl create token` can now be used to request a service account token, and permission to request service account tokens is added to the `edit` and `admin` RBAC roles

/cc @deads2k @zshihang @soltysh
/sig auth cli

[liggitt]

/retest

[liggitt]

unsure whether we want this here or under kubectl create token, etc

[liggitt]

/assign @micahhausler
who volunteered to review

(wait to review until I relocate this to kubectl create and rework it in that form ... will probably be next week)

[zshihang]

this new command would be very useful.

/lgtm

[liggitt]

/hold
want review of the server-side change by @deads2k

[liggitt]

dropped uid precondition / population bits

[deads2k]

/lgtm