feat: add logic to handle updates to operator config

[mjnagel]

Description

This PR adds logic to handle updates to the operator config, specifically managed via the operator secret. In particular this adds:

• A watch on the operator config secret
• A function to manage changes to that secret
• Logic to specifically handle additions/changes/deletions of the authservice config (redis and ca cert)
• Logic to handle updates to the CIDR ranges for nodes/kubeapi
• Stubbed out logic to handle updates to domain and admin domain (this would be a larger effort to fully implement so leaving a TODO on this)

Related Issue

Fixes #1130

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Other (security config, docs update, etc)

Steps to Validate

# Deploy slim-dev with unicorn flavor (or other flavor)
uds run slim-dev --set flavor=unicorn

# Validate an update to redis URI takes effect
## Edit the operator secret
kubectl edit secret -n pepr-system uds-operator-config
## Add `cmVkaXM6Ly90ZXN0` as the value for `AUTHSERVICE_REDIS_URI` (this is base64 encoded `redis://test`)
## Validate that Pepr watcher logs indicate it cycled authservice
kubectl logs -n pepr-system deploy/pepr-uds-core-watcher | grep "Updating Authservice secret"
## Validate that Authservice cycled and is trying to use our fake redis url
kubectl logs -n authservice deploy/authservice --all-pods # You should see `redis-url="redis://test"`
## Edit the operator secret
kubectl edit secret -n pepr-system uds-operator-config
## Remove the `AUTHSERVICE_REDIS_URI` value (change to empty string)
## Validate that Pepr watcher logs indicate it cycled authservice
kubectl logs -n pepr-system deploy/pepr-uds-core-watcher | grep "Updating Authservice secret"
## Validate that Authservice cycled and is no longer using redis
kubectl logs -n authservice deploy/authservice --all-pods # It shouldn't have redis listed

# You could redo these same steps with a CA Cert value, just make sure that the value you use is "double" base64 encoded since we expect it to be base64 encoded, and then the secret requires it to be base64 encoded as well

# Validate updates to the CIDR values
## Deploy monitoring layer to add some test resources
uds run test:single-layer --set LAYER=monitoring --set FLAVOR=unicorn
## Edit the operator secret
kubectl edit secret -n pepr-system uds-operator-config
## Set both `KUBEAPI_CIDR` and `KUBENODE_CIDRS` to `MTkyLjE2OC4wLjEvMzI=` (this is `192.168.0.1/32` base64 encoded)
## Validate that Pepr watcher logs indicate it updated network policies
kubectl logs -n pepr-system deploy/pepr-uds-core-watcher | grep "Updating KubeNodes"
kubectl logs -n pepr-system deploy/pepr-uds-core-watcher | grep "Updating KubeAPI"
## Validate the network policies actually have our new IP (`192.168.0.1/32`)
kubectl get networkpolicy -n monitoring allow-prometheus-stack-egress-kube-prometheus-stack-admission-create-kubeapi -o yaml
kubectl get networkpolicy -n monitoring allow-prometheus-stack-egress-metrics-scraping-of-kube-nodes -o yaml

Checklist before merging

• Test, docs, adr added or updated as needed
• Contributor Guide followed

[mjnagel]

@noahpb identified an issue where empty strings weren't being handled properly for the redis uri and ca cert, made some modifications and added tests to make sure those scenarios are properly handled. Should be g2g again for review.