WIP.  Robot account proposal.

In a rough state but putting out for comment.

There has been considerable discussion about the general problem of secret distribution for docker and kubernetes.
While that is a great goal, I think it will take some time.
In the shorter term, I want to be able to just distribute secrets for access to the kubernetes API.
This proposal just focuses on that.

That problem is important to solve because:
  - it lets us run scheduler and controller-manager via /pods
  - lets users write their own services, like cron, build controllers, etc, more easily.
  - gets us closer to self-hosting.
I'm not in love with "robot account" (too cutesy) - "service account" is fairly commonly used in both Windows and Kerberos (and even has fairly good overlap with our terminology, except for the potential point of confusion that it's directly related to services), "machine account" is a bit more generic.  "Infrastructure account"?  "cluster account"?

I do like the general concept and overall shape of the proposal.