Add UpstreamOIDCProvider API type definition.

This is essentially just a copy of Andrew's work from https://github.com/vmware-tanzu/pinniped/pull/135.

Signed-off-by: Matt Moyer <moyerm@vmware.com>

deploy/supervisor/rbac.yaml

@@ -19,6 +19,12 @@ rules:
   - apiGroups: [config.supervisor.pinniped.dev]
     resources: [oidcproviders]
     verbs: [update, get, list, watch]
+  - apiGroups: [idp.supervisor.pinniped.dev]
+    resources: [upstreamoidcproviders]
+    verbs: [get, list, watch]
+  - apiGroups: [idp.supervisor.pinniped.dev]
+    resources: [upstreamoidcproviders/status]
+    verbs: [get, patch, update]
 ---
 kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1

deploy/supervisor/z0_crd_overlay.yaml

@@ -9,3 +9,9 @@
 metadata:
   #@overlay/match missing_ok=True
   labels: #@ labels()
+
+#@overlay/match by=overlay.subset({"kind": "CustomResourceDefinition", "metadata":{"name":"upstreamoidcproviders.idp.supervisor.pinniped.dev"}}), expects=1
+---
+metadata:
+  #@overlay/match missing_ok=True
+  labels: #@ labels()