Move the CSR controller's variant knowledge behind an extension

[caseydavenport]

Description

Split out of #5170 to keep that review smaller, and the first of the per-controller ones. The CSR controller had a hardcoded table of Enterprise certificates plus variant checks scattered through the reconcile, so it only signed the right things because it knew what product it was running as. That knowledge moves to an extension:

• the signable assets and whether the signing ClusterRole is needed come from the extension
• requests that no pod issued get their subject from a resolver the extension supplies
• assets that more than one service account may request carry their own authorizer instead of a special case in the controller
• the extension registers its own watches, so creating a NonClusterHost triggers a reconcile rather than waiting on an unrelated event

The core controller keeps the signing, the approval, and the request validation. With no extension registered it signs the same set it always did.

Release Note

None