Syncer uses minimal permissions in workload cluster

[pweil-]

Proposal: webhook admission controller to ensure only syncer is creating namespaces with the configured prefix Proposal: RBAC controller to grant syncer full access to namespaces with the configured prefix Proposal: installing both of the above when we install syncer, health-checking them when determining cluster readiness

[mjudeikis]

/transfer-issue contrib-tmc