Auth plugins

This supercedes #1358. 

Since some folks want a very simple default implementation for auth, and others want to be able to plug in a more full-featured implementation, I've focused on the problem of defining how Authorization plugs in.

In the process, I found I was unable to talk about that without also defining how Authentication and Group Membership should plug in.  

I've also removed the text from access.md about "userAccounts", since I no longer feel that is resource type has to be part of kubernetes.
Seems like the current flows around /auth are browser-centric (they assume cookie capability, or ability to handle UI around external OAuth flows). Would an API client like kubecfg be able to interface with /auth in a reliable way, regardless of what flow or redirect an IdentityProvider chose to implement, or do we need a separate endpoint for non-browser auth? Wondering if the IdentityProvider interface would need to react differently to browser and API clients