Use consistent helper for getting secret names from pod

[liggitt]

Kubelet secret-manager and mirror-pod admission both need to know what secrets a pod spec references. Eventually, a node authorizer will also need to know the list of secrets.

This creates a single (well, double, because api versions) helper that can be used to traverse the secret names referenced from a pod, optionally short-circuiting (for places that are just looking to see if any secrets are referenced, like admission, or are looking for a particular secret ref, like authorization)

Fixes:

• secret manager not handling secrets used by env/envFrom in initcontainers
• admission allowing mirror pods with secret references

@smarterclayton @wojtek-t

[k8s-reviewable]

This change is 

[liggitt]

still trying to figure out how to catch drift

[wojtek-t]

/lgtm
/approve

[k8s-github-robot]

[APPROVALNOTIFIER] This PR is APPROVED

The following people have approved this PR: liggitt, wojtek-t

Needs approval from an approver in each of these OWNERS Files:

• pkg/api/pod/OWNERS [wojtek-t]
• pkg/api/v1/OWNERS [wojtek-t]
• pkg/kubelet/OWNERS [wojtek-t]
• plugin/pkg/admission/serviceaccount/OWNERS [liggitt,wojtek-t]

You can indicate your approval by writing /approve in a comment
You can cancel your approval by writing /approve cancel in a comment

[liggitt]

@k8s-bot cvm gce e2e test this

[k8s-github-robot]

Automatic merge from submit-queue (batch tested with PRs 41814, 41922, 41957, 41406, 41077)

[k8s-ci-robot]

@liggitt: The following test(s) failed:

Test name	Commit	Details	Rerun command
Jenkins non-CRI GCE Node e2e	a552630	link	@k8s-bot non-cri node e2e test this

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.