WIP.  Robot account proposal.

In a rough state but putting out for comment.

There has been considerable discussion about the general problem of secret distribution for docker and kubernetes.
While that is a great goal, I think it will take some time.
In the shorter term, I want to be able to just distribute secrets for access to the kubernetes API.
This proposal just focuses on that.

That problem is important to solve because:
  - it lets us run scheduler and controller-manager via /pods
  - lets users write their own services, like cron, build controllers, etc, more easily.
  - gets us closer to self-hosting.
I don't even think you can enforce this in regular practice - we should state that the kubelet will use the first secret in the secret list with SecretTypeKubernetesAuth, and you can atomically manage the order in the Robot if you care.