"Grant" permissions to ArgoCD by namespace labels

About

In order to enable ArgoCD in namespace "foo" to deploy workloads in namespace "bar", the user needs to grant ArgoCD permissions to do so by creating a role-binding and add the namespace in the cluster secret.

There are issues with these approach:

1. The name of the application controller's service account is a detail we should not be exposing users too. https://github.com/siamaksade/openshift-gitops-getting-started/blob/main/cluster/namespace/spring-petclinic-rolebinding.yaml
2. The approach needs heavy documentation and separate yaml on Git!
3. If the service account name changes, it's a detail we would be exposing the user to.

In order to make this experience less error-prone, we should support the following

1. A namespace admin labels her namespace with the name+namespace associated with the ArgoCD instance that she wants to have manage her namespace.
2. Add the namespace to the cluster secret in the namepace where the argocd instance is deployed in.
3. .. and that's it! 

Implementation notes:

Our GitOps Operator controller should watch for namespaces with that label and create the correct rolebinding(s).

Acceptance criteria

• The Operator implements the operations as described in the design document
• All scenarios (creating, removing and migrating) are properly tested
• The mechanism is properly documented for the users of the Operator