Introduce the namespaced internal.cozystack.io/v1alpha1 group and its
TenantProjection kind. A chart renders this sentinel to declare which
of an application's Secrets should be published to its tenant as a
key-free copy; the controller reconciles the projected Secret from it.
No tenant RBAC role grants any verb on internal.cozystack.io, so the
sentinel cannot be forged from a tenant namespace.
Signed-off-by: Aleksei Sviridkin <f@lex.la>
