Add uidenforcer admission controller

Enforces that:

• All namespaces have a RunAsUser annotation
• Namespaced users can't touch annotations on their own namespace
• Pods in a namespace will have RunAsUser set in all the containers to the RunAsUser annotation
• Requires whitelisting of the resources that each user can access in an ABAC file
• Does not let non-empty SecurityContexts pass through at all, since they can have capabilities or other dangerous things in the future

Change-Id: Ie9fc11c5f8849225b04ac3e581e2eaafaf36bc44