Send Tekton installation namespace to EL

The EventListener did not have knowledge of which namespace Triggers was
installed in. Instead it always assumed it was `tekton-pipelines` leading to
the bug described in tektoncd#923.  This commit fixes this by having the Reconciler
send the installation namespace as a environment variable set on the
EventListener's pod.

NOTE: This fix is temporary and should not be necessary once tektoncd#868 is
implemented since then we will resolve the Interceptor's address using
information from its CRD.

Fixes tektoncd#923

Signed-off-by: Dibyo Mukherjee <dibyo@google.com>

Add missing namespace to core-interceptors role

Deprecate PodTemplate and ServiceType in favour of Resource

Merge extensions into body for webhook interceptors

With CEL interceptor writing to the `extensions` field, it is impossible to
chain added fields from a CEL interceptor to a webhook interceptor today. This
is because we do not pass the extensions field to the webhook interceptor yet.

This commit attempts to fix this by merging any extensions to the body before
sending it over to the Webhook interceptor. This is temporary until we fully
move webhook interceptors to the new pluggable interface. One implication of
this change is that the body may now contain an `extensions` field separate
from the top level extensions field if one uses the Webhook interceptor.

In addition, the CEL environment also did not have access to extensions which I
fixed.

Fixes tektoncd#857

Signed-off-by: Dibyo Mukherjee <dibyo@google.com>

Add extensions support to CEL

Fix example SA permissions

The service account used for examples had permissions for all namespaced
Triggers resources but not `clustertriggerbindings`. With the switch to using
listers instead of making direct API calls this means that the EL will keep
printing out error log messages about not being able to fetch
clustertriggerbindings. To fix this, I added updated the SA with the right
ClusterRole and Binding.

In addition, some of the examples were using their own roles/SAs/bindings.
Instead of updating those, I created a single `rbac.yaml` file and added
symlinks to it from the examples.

Fixes tektoncd#846

Signed-off-by: Dibyo Mukherjee <dibyo@google.com>

Updated README for trigger selector based examples

Revert "dibyo's point about only EL sink/interceptors reading secrets"

This reverts commit 8eb2067.

Turns out, the webhook does need access to create secrets since it uses it
to create `tekton-webhook-certs` if it does not exist.

Fixes tektoncd#803

Migrate all usages of template.name to template.ref

Signed-off-by: Dibyo Mukherjee <dibyo@google.com>

Merge annotations on created resources

In tektoncd#712, we added a feature to propagate annotations added to the EL to its
underlying resources. However, this resulted in infinite reconcile loops since
the deployment controller will add a standard revision annotation that the EL
controller will keep trying to overwrite. To fix this, this commit switches the
annotation propagation to merge any annotations set on the underlying resources
before adding any extra annotations from the EL.

Fixes tektoncd#752

Signed-off-by: Dibyo Mukherjee <dibyo@google.com>

Add TriggerCRD object validation and default

Defaults and Validation for TriggerCRD object have been added.