Allow disabling cross-namespace references

[stefanprodan]

Given that RFC-0002 and RFC-0003 need more debating, I propose we add a boolean flag --no-cross-namespace-refs to all controllers so that users can disable cross-namespace references if they wish to do so.

This applies to:

• GitRepository, Bucket and HelmRepository references in Kustomizations and HelmReleases
• ImageRepository references in ImagePolicies
• GitRepository references in ImageUpdateAutomations
• Kustomization, HelmRelease, image and source references in Alerts

Flag spec:

flag.BoolVar(&noCrossNamespaceRefs, "no-cross-namespace-refs", false,
	"When set to true, references between custom resources are allowed " +
	"only if the reference and the referee are in the same namespace.")

Components:

• fluxcd/pkg/runtime
• kustomize-controller
• helm-controller
• notification-controller
• image-reflector-controller
• image-automation-controller

[squaremo]

👍 I think this is sensible, and has a use even if/when ACLs are also implemented in the same controllers.

[makkes]

I like the idea!

[stefanprodan]

Thanks @somtochiama and @squaremo for helping out implementing this on such short notice.