Allow to grant a k8s role binding on a service account

[jlevesy]

What needs to be done?

A cool feature would be to define a potential grantee in an escalation grant directly, for example in the K8sRoleBinding grant we could write something like this

# some-policy.yaml
target:
   grants:
    - kind: KubernetesRoleBinding
      defaultNamespace: some-app
      allowedNamespaces:
        - some-app
        - some-other-app
      grantee:  # <- this !
        kind: ServiceAccount
        name: super-app
      roleRef:
        kind: ClusterRole
        name: config-viewer
        apiGroup: rbac.authorization.k8s.io

In that case, kudo will create the role binding not for the requestor, but for the grantee defined by the policy in the namespace picked by the policy.

This could open up a bunch of cool use cases like granting temporarily more permissions to a workload.

Kudos to @dduportal for the idead 🎉

Acceptance Criteria

• Kudo allows granting permissions to a third party grantee defined in policy
• an e2e test has been written to prove this