Enhance audit logging, especially for authorization

[s-urbaniak]

Currently, we leave little traces about authorizers besides native kube RBAC ones.

Native kube RBAC authorizer creates audit log entries for two cases:

allowed:

• client: client gets no reason (expected)
• audit: reason is encoded in the audit annotation:
  "authorization.k8s.io/reason": "RBAC: allowed by RoleBinding \"foo\" of Role \"bar\" to User \"baz\""

denied:

• client: client gets a simplified reason of denial, example:
  Error from server (Forbidden): pods is forbidden: User "foo" cannot list resource "bar" in API group "" in the namespace "baz"
• audit: reason is only encoded in the message, not in the audit annotation without further details:
  "message": "pods is forbidden: User \"foo\" cannot list resource \"bar\" in API group \"\" in the namespace \"baz\"", "authorization.k8s.io/reason": ""

For kcp I suggest to create dedicated annotations per authorizer (api-binding, top level, content) and set potential reasoning messages for both denial and allowed requests, examples:

• apibinding.authorization.kcp.io/decision: "allow/forbid"
• toplevel.authorization.kcp.io/decision: "allow/forbid"
• content.authorization.kcp.io/decision: "allow/forbid"
• apibinding.authorization.kcp.io/reason: "allowed, no maximal local permission policy present"
• apibinding.authorization.kcp.io/reason: "forbidden by RBAC in API Export cluster \"foo\"" (reason will be encoded via message , see above)
• content.authorization.kcp.io/reason: "allowed by cluster local service account (extraGroups=[\"system:kcp:clusterworkspace:access\"])"
• content.authorization.kcp.io/reason: "allowed by \"admin\" verb in workspace \"foo\" (extraGroups=[\"system:kcp:clusterworkspace:access\",\"system:kcp:clusterworkspace:admin\"])"

[sttts]

👍

[sttts]

s/kcp.io/kcp.dev/

[ncdc]

#1767 implements annotations for content & toplevel