Introduce AuthorizationPolicy CRDs

[olix0r]

Issue #7709 proposes new Custom Resource types to support generalized
authorization policies:

• AuthorizationPolicy
• MeshTLSAuthentication
• NetworkAuthentication

This change introduces these CRDs to the default linkerd installation
(via the linkerd-crds chart) and updates the policy controller's
to handle these resource types. The policy admission controller
validates that these resource reference only suppported types.

This new functionality is tested at multiple levels:

• linkerd-policy-controller-k8s-index includes unit tests for the
  indexer to test how events update the index;
• linkerd-policy-test includes integration tests that run in-cluster
  to validate that the gRPC API updates as resources are manipulated;
• linkerd-policy-test includes integration tests that exercise the
  admission controller's resource validation; and
• linkerd-policy-test includes integration tests that ensure that
  proxies honor authorization resources.

This change does NOT update Linkerd's control plane and extensions to
use these new authorization primitives. Furthermore, the linkerd CLI
does not yet support inspecting these new resource types. These
enhancements will be made in followup changes.

[kleimkuhler]

Overall this looks good. There's a decent amount of test code that will become more clear after maybe writing some tests myself, but the CRD changes along with the indexing all make sense.

[kleimkuhler]

This makes sense but was not immediately obvious. I don't think it's a lack of documentation, more just leaving this comment as an explanation to myself. In order for multiple identities to be authorized by an AuthorizationPolicy, we only can select at most one MeshTLSAuthentication. This MeshTLSAuthentication can select multiple identities though, so all those identities will be authorized clients to whatever the targetRef is.