Allow API Gateway controller to get Namespaces

[nathancoleman]

Changes proposed in this PR:
Allow the Consul API Gateway controller to get, list and watch namespaces. This enables the controller to validate HTTPRoutes before attaching them to a Gateway that uses a namespace selector for allowedRoutes.

In this example, the Gateway only allows routes from a K8s Namespace with labels matching amAllowed: sure:

apiVersion: gateway.networking.k8s.io/v1alpha2
kind: Gateway
metadata:
  name: example-gateway
  namespace: consul
spec:
  gatewayClassName: consul-api-gateway
  listeners:
    - allowedRoutes:
        namespaces:
          from: Selector
          selector:
            matchLabels:
              amAllowed: sure
      name: http
      port: 80
      protocol: HTTP

Before the controller attaches a route to this gateway, it needs to retrieve the namespace and see if the label selector matches, thus these new permissions.

How I've tested this PR:
Tested as part of analogous PR, hashicorp/consul-api-gateway#121.

How I expect reviewers to test this PR:
Follow testing described in hashicorp/consul-api-gateway#121.

Checklist:

• Tests added
• CHANGELOG entry added

  HashiCorp engineers only, community PRs should not add a changelog entry.
  Entries should use present tense (e.g. Add support for...)

[mikemorris]

LGTM from the API Gateway side, not sure if there's a test we should add to cover this.

[kschoche]

LGTM from the API Gateway side, not sure if there's a test we should add to cover this.

@mikemorris Agree! Since nothing is being added that is configurable/templated I think its fine to use the existing bats test which asserts that the clusterrole gets added when apigw is enabled.

[kschoche]

👍🏽