Expose Kibana keystore for secure settings

[sebgl]

Expose Kibana keystore the same way it's done in Elasticsearch through a user-provided secret reference:

# This sample sets up a single Kibana instance pointing to a remote Elasticsearch cluster
apiVersion: kibana.k8s.elastic.co/v1alpha1
kind: Kibana
metadata:
  name: kibana-sample
spec:
  version: 7.1.0
  nodeCount: 1
 secureSettings:
   secretName: kb-secure-settings

Contrary to Elasticsearch, we don't reconcile the user secret contents into our own secret, but we mount the user secret into the pod directly.
Kibana being stateless and secure settings being loaded at Kibana startup, it's simpler to just recreate Kibana pods if there is any changes in secure settings. This is done through propagating the user secret resource version into the pod labels.
The user secret needs to be in the same namespace as Kibana, and will be watched by the operator dynamic watches for reconciliation.

Fixes #755.

[pebrc]

Are we not moving all of those scripts into config maps?

[sebgl]

We could do that, yes. I have mixed feelings though: that's another configmap to manage (a single one for multiple clusters?) + another volume to mount in the ES pod + another VolumeMount to setup in the init container to avoid 10 lines of bash in the pod spec (but probably adds more than 10 lines in the json-prettified pod spec because of additional volumes).
I can also reduce this to ~5 lines of bash.

[thbkrkr]

LGTM!