Add namespace selector as scope

Currently there're are 3 scopes how a Sealed Secret can be encrypted:

• strict
• namespace
• cluster-wide

We're maintaining a multi-tenant cluster and users are asking how they can reuse an existing Sealed Secret for a different namespace without encrypting again or make them cluster-wide.

A possible approach would be to support encryption of Sealed Secrets using a namespace selector as each tenant has its own set of labels on their namespaces.

Something like:

kubeseal --scope namespace-selector --selector owner=team1 -oyaml < secret.yaml > sealedsecret.yaml

The Sealed Secrets controller would only decrypt the Sealed Secret if the corresponding namespace has the label owner set to team1.

What are your thoughts about adding namespace selector as scope? Is this a feature which we might add?