Access.md added.

Some thoughts around identity and access management.  
Ideas still rough, but trying to share early.  Comments welcomed.

Some of this maybe should go into docs/security.md
How would bearer auth be correctly handled in an http proxy?  How do things like scopes (which are part of tokens) get applied correctly by the proxy in an efficient manner without writing a complex proxy plugin?  Most enterprise auth solutions will have no notion of bearer auth and the complexity of setup there would be fairly severe (since you'd have to write custom proxy code).  I would assume that you'd want bearer auth to be a k8s level plugin.  Custom proxy plugin code seems an order of magnitude more complex than a h8s level plugin, even if it has to be compiled in.