feat(controller): add impersonation group filter options

[oliverbaehler]

Adds options to filter groups that will be impersonated. We experienced based on the correction in (#331) that the performance greatly decreased because of the amount of groups we have in the claim and the resulting requests to the API server.

With these options the amount of groups which are considered for impersonated can be decreased resulting in less requests.

@MaxFedotov wdyt? Do you also experience performance issues? did you also change the qos and burst of the kube client?

Maybe we can do additional adjustments to improve the performance. But i can't think of anything else to decrease the requests made to the API to request impersonation. Batching all the groups would help, however there's nothing on the kubernetes API which would offer such a function.

Maybe adding FlowSchemes and APIPriority might also help.

[prometherion]

Maybe adding FlowSchemes and APIPriority might also help.

Isn't this already fixable with client-based QPS and burst?

capsule-proxy/main.go

Lines 85 to 86 in fcfa171

	flag.Float32Var(&clientConnectionQPS, "client-connection-qps", 20.0, "QPS to use for interacting with kubernetes apiserver.")
	flag.Int32Var(&clientConnectionBurst, "client-connection-burst", 30, "Burst to use for interacting with kubernetes apiserver.")

[oliverbaehler]

@prometherion Yes sure

[prometherion]

LGTM, I remember we had similar issues with #306, maybe @msergg and @y0psolo could be interested.