Add support for multi-tenancy

[lmilleri]

Enable multi-tenancy in the trustee-operator so each tenant can create a TrusteeConfig in their namespace and get a separate, isolated trustee instance.

Current Architecture

• CRDs: KbsConfig and TrusteeConfig are namespaced resources
• RBAC: Operator has cluster-wide permissions (ClusterRole)
• Limitation: KbsConfigReconciler watches only ConfigMaps/Secrets in operator's namespace (trustee-operator-system) via namespace predicates
• Resources: Already created in same namespace as CR, with proper owner references

[lmilleri]

Design document: https://gist.github.com/lmilleri/68bcac85837dddd602b135380b0545a7