Add whitelisted namespaced resources support

[dontreboot]

Summary

Support whitelisted namespaces resources instead of supporting blacklisted namespaced resources

Motivation

I think it's harder to maintain a blacklist than a whitelist here. With a blacklist, whenever people add CRDs, they will have to remember to update the blacklist to explicitly deny access the new resources. With a whilelist, we define a list of known resources.

The model is similar to grant user access with deny all as the default when we grant more access based on needed which is a basically a "whiltelist" model.

Proposal

See #Motivation

[kanapuli]

I would like to raise a PR for this. This is a much needed feature

[alexmt]

Implemented by #3314