Karmada plugin shoule use User Impersonation to limit access permission expansion #5485

What happened:

When the request reaches the federated cluster, if the cache and cluster plugin cannot handle it, the request reaches the karmada plugin, which uses the admin permissions to access the federated cluster kube-apiserver, causing the cluster access permissions amplification problem.

https://github.com/karmada-io/karmada/blob/master/pkg/search/proxy/framework/plugins/karmada/karmada.go#L81

What you expected to happen:

We should use User Impersionation to control user access rights.

How to reproduce it (as minimally and precisely as possible):

Anything else we need to know?:

Environment:

• Karmada version:
• kubectl-karmada or karmadactl version (the result of kubectl-karmada version or karmadactl version):
• Others: