apiext: rewrite to fix CA cert renewal and enhance capabilities

Description

This PR looks to fix the long standing issue with CA Certs not auto-renewing and becoming expired thus no longer being able to convert CRD's until a new CA cert is re-created. It expands the capabilities to allow for more flexibility in allowing the CA Cert and CRD Patching to be externally managed by third parties such as CertManager. Also, leverages leader-election to ensure predictability when managed CA Cert and CRD Patching.

APIExt design

The new design is built on top of the controller-runtime using the familiar Runnable and Controller patterns. The following are the key abstractions created.

Entity	Description	Required	Leader Election
CertificateAuthority	Internal CA Cert cache that generates Server Certificates	Yes	No
caCertController	Controller watching CA Cert Secret and providing CertificateAuthority the CACert	Yes	No
crdPatchController	Controller patching getambassador.io CRDs to ensure CABundle matches CACert	No	Yes
CACertManager	Runnable watching CA Cert Secret and ensuring it is always valid and non-expired	No	Yes

Note: crdPatchController and CACertManager can be disabled but the capabilities they provide are required so if disabled then it is up to the user to provide an alternative such as CertManager.

Now that we support LeaderElection the RBAC has been expanded to include the new permissions needed.

One other thing to mention, is that this PR laid the ground work for publishing the apiext as a stand alone container by decoupling its binary from busy ambassador. However, for now the standalone container is only used to simplify the e2e testing (mainly due to keeping scope down, in an already large PR). The standalone binary is still copied into the core container and the deployment in the charts/manifest are still the same.

Related Issues

CA Cert Renewal and support for externally managing CA Cert and CRD Patching.

Testing

New unit tests for rewrite and added automated e2e tests to CI. Pulled into Edge Stack and verified no issues there as well.

Checklist

[ ] Does my change need to be backported to a previous release?
[ ] I made sure to update CHANGELOG.md.
[x] This is unlikely to impact how Ambassador performs at scale.
[x] My change is adequately tested.
[ ] I updated DEVELOPING.md with any any special dev tricks I had to use to work on this code efficiently.
[x] The changes in this PR have been reviewed for security concerns and adherence to security best practices.

emissary-ingress / emissary