Fix bug which prevented watches from working through impersonator

Also:
- Changed base64 encoding of impersonator bearer tokens to use
  `base64.StdEncoding` to make it easier for users to manually
  create a token using the unix `base64` command
- Test the headers which are and are not passed through to the Kube API
  by the impersonator more carefully in the unit tests
- More WIP on concierge_impersonation_proxy_test.go

Signed-off-by: Margo Crawford <margaretc@vmware.com>

cmd/pinniped/cmd/login_oidc.go

@@ -294,7 +294,7 @@ func execCredentialForImpersonationProxy(
 	if err != nil {
 		return nil, fmt.Errorf("Error creating TokenCredentialRequest for impersonation proxy: %w", err)
 	}
-	encodedToken := base64.RawURLEncoding.EncodeToString(reqJSON)
+	encodedToken := base64.StdEncoding.EncodeToString(reqJSON)
 	cred := &clientauthv1beta1.ExecCredential{
 		TypeMeta: metav1.TypeMeta{
 			Kind:       "ExecCredential",

cmd/pinniped/cmd/login_oidc_test.go

@@ -288,5 +288,5 @@ func impersonationProxyTestToken(token string) string {
 			},
 		},
 	})
-	return base64.RawURLEncoding.EncodeToString(reqJSON)
+	return base64.StdEncoding.EncodeToString(reqJSON)
 }