feat: automated CSR workflow

[andrewrynhard]

Since #64 was merged, we now enforce security without the possibility of opting out. CSRs need to be automated for nodes as they come up. One way to achieve this would be to define a CustomResourceDefinition (or more than one) along with a controller that would automate the CSR workflow.