Add nsaccess package to determine if a user "has access" to a namespace

[jpellizzari]

Closes #1725

The goal of this work was to be able to provide a list of Kubernetes namespaces that a user can access. "Access" in this context, is determined by a minimum set of actions a user can take. In the default case, those actions map directly to the things that the wego-app can do.

Some thoughts:

• This feels wrong: is there not already some k8s machinery that can do this? I looked at lots of different source code, but could not find anything that does exactly this.
• The hasAllRules function is very un-go like to me, but given how flexible the rules can be, I chose to model this as a string-matching problem. Any input on that section would be appreciated.

CC @JamWils This is the brute force approach we had discussed, with an opening for a different (better?) implementation in the future.

[yitsushi]

a small nit, otherwise lgtm

(hasAllRules is a bit chaotic)

[yitsushi]

This can be

func newNamespace(ctx context.Context, k client.Client, g *GomegaWithT) corev1.Namespace {
	ns := corev1.Namespace{}
	ns.Name = "kube-test-" + rand.String(5)

	g.Expect(k.Create(ctx, &ns)).To(Succeed())

	return ns
}

It's kind of the same, but looks less weird with return *ns.

[luizbafilho]

Minor comment to help out clean up the tests

[luizbafilho]

we can simplify the user config creation by just:

userCfg := *testCfg

userCfg.Impersonate = rest.ImpersonationConfig{
	UserName: userName,
}

[jpellizzari]

TODO:

	t.Run("works when a user has * permissions on a resource", func(t *testing.T) {

	})