Add uidenforcer admission controller
Enforces that:
- All namespaces have a RunAsUser annotation
- Namespaced users can't touch annotations on their own namespace
- Pods in a namespace will have RunAsUser set in all the containers to the RunAsUser annotation
- Requires whitelisting of the resources that each user can access in an ABAC file
- Does not let non-empty SecurityContexts pass through at all, since they can have capabilities or other dangerous things in the future
Change-Id: Ie9fc11c5f8849225b04ac3e581e2eaafaf36bc44