Make authentication less dependent on cluster wide objects

Start by reading the related issue 807, then review the AuthenticationClass and SecretClass manifest concepts and the TrinoCluster authentication examples in this issue. Map the affected product manifests and decide how both namespaced Secret references and inline authentication manifests can be added backward compatibly; done means the proposed authentication flows no longer require cluster-wide objects.

Description

Part of https://github.com/stackabletech/issues/issues/807

Authentication in SDP involves managing AuthenticationClass and SecretClass objects, among other things.

These are cluster wide objects that can usually only be created by cluster administators.

Users must reference secret/authentication classes in product manifests and are therefore dependent RBAC permissions that are not available to them on most organizational policies.

To resolve this dependency, we propose two backward compatible changes that, taken togehther would make it sufficient to implement authentication with namespaced objects only.

The changes:

1. The first change is to add a new field to AuthenticationClass manifests. The field would be a reference to a Secret (namespaced) that can be used instead of the reference to the existing SecretClasses (cluster wide).

Example:

kind: AuthenticationClass
spec:
  provider:
    ldap:
      hostname: my.ldap.server 
      port: 389 
      searchBase: ou=users,dc=example,dc=org 
      bindCredentials:
        secretClass: openldap-bind-credentials
        # OR # <<< NEW COMPLEX ENUM
        secretName: openldap-bind-credentials # <<<< NEW FIELD

2. The second change is to allow product manifests to inline authentication manifests instead of referncing cluster wide objects.

apiVersion: trino.stackable.tech/v1alpha1
kind: TrinoCluster
metadata:
  name: simple-trino
spec:
  clusterConfig:
    authentication:
      - authenticationClass: simple-trino-users
      - authenticationClass: my-openldap
      # OR <<< NEW COMPLEX ENUM
      - experimentalInlinedAuthenticationClass: # or maybe inlinedAuthenticationClass
          provider:
            static:
              userCredentialsSecret:
                name: trino-users
      - experimentalInlinedAuthenticationClass:
          provider:
            ldap: # ...