Allow multiple Pinnipeds to work on same cluster

Yes, this is a huge commit.

The middleware allows you to customize the API groups of all of the
*.pinniped.dev API groups.

Some notes about other small things in this commit:
- We removed the internal/client package in favor of pkg/conciergeclient. The
  two packages do basically the same thing. I don't think we use the former
  anymore.
- We re-enabled cluster-scoped owner assertions in the integration tests.
  This code was added in internal/ownerref. See a0546942 for when this
  assertion was removed.
- Note: the middlware code is in charge of restoring the GV of a request object,
  so we should never need to write mutations that do that.
- We updated the supervisor secret generation to no longer manually set an owner
  reference to the deployment since the middleware code now does this. I think we
  still need some way to make an initial event for the secret generator
  controller, which involves knowing the namespace and the name of the generated
  secret, so I still wired the deployment through. We could use a namespace/name
  tuple here, but I was lazy.

Signed-off-by: Andrew Keesler <akeesler@vmware.com>
Co-authored-by: Ryan Richard <richardry@vmware.com>

internal/config/concierge/config.go

@@ -13,6 +13,7 @@ import (
 	"sigs.k8s.io/yaml"
 
 	"go.pinniped.dev/internal/constable"
+	"go.pinniped.dev/internal/groupsuffix"
 	"go.pinniped.dev/internal/plog"
 )
 
@@ -47,6 +48,10 @@ func FromPath(path string) (*Config, error) {
 		return nil, fmt.Errorf("validate api: %w", err)
 	}
 
+	if err := validateAPIGroupSuffix(*config.APIGroupSuffix); err != nil {
+		return nil, fmt.Errorf("validate apiGroupSuffix: %w", err)
+	}
+
 	if err := validateNames(&config.NamesConfig); err != nil {
 		return nil, fmt.Errorf("validate names: %w", err)
 	}
@@ -121,6 +126,10 @@ func validateAPI(apiConfig *APIConfigSpec) error {
 	return nil
 }
 
+func validateAPIGroupSuffix(apiGroupSuffix string) error {
+	return groupsuffix.Validate(apiGroupSuffix)
+}
+
 func int64Ptr(i int64) *int64 {
 	return &i
 }

internal/config/concierge/config_test.go

@@ -175,7 +175,7 @@ func TestFromPath(t *testing.T) {
 				api:
 				  servingCertificate:
 					durationSeconds: 2400
-					renewBeforeSeconds: -10
+					renewBeforeSeconds: 0
 				names:
 				  servingCertificateSecret: pinniped-concierge-api-tls-serving-certificate
 				  credentialIssuer: pinniped-config
@@ -183,6 +183,22 @@ func TestFromPath(t *testing.T) {
 			`),
 			wantError: "validate api: renewBefore must be positive",
 		},
+		{
+			name: "InvalidAPIGroupSuffix",
+			yaml: here.Doc(`
+				---
+				api:
+				  servingCertificate:
+					durationSeconds: 3600
+					renewBeforeSeconds: 2400
+				apiGroupSuffix: .starts.with.dot
+				names:
+				  servingCertificateSecret: pinniped-concierge-api-tls-serving-certificate
+				  credentialIssuer: pinniped-config
+				  apiService: pinniped-api
+			`),
+			wantError: "validate apiGroupSuffix: 1 error(s):\n- a lowercase RFC 1123 subdomain must consist of lower case alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character (e.g. 'example.com', regex used for validation is '[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*')",
+		},
 	}
 	for _, test := range tests {
 		test := test

internal/config/supervisor/config.go

@@ -13,6 +13,7 @@ import (
 	"sigs.k8s.io/yaml"
 
 	"go.pinniped.dev/internal/constable"
+	"go.pinniped.dev/internal/groupsuffix"
 	"go.pinniped.dev/internal/plog"
 )
 
@@ -36,6 +37,10 @@ func FromPath(path string) (*Config, error) {
 
 	maybeSetAPIGroupSuffixDefault(&config.APIGroupSuffix)
 
+	if err := validateAPIGroupSuffix(*config.APIGroupSuffix); err != nil {
+		return nil, fmt.Errorf("validate apiGroupSuffix: %w", err)
+	}
+
 	if err := validateNames(&config.NamesConfig); err != nil {
 		return nil, fmt.Errorf("validate names: %w", err)
 	}
@@ -53,6 +58,10 @@ func maybeSetAPIGroupSuffixDefault(apiGroupSuffix **string) {
 	}
 }
 
+func validateAPIGroupSuffix(apiGroupSuffix string) error {
+	return groupsuffix.Validate(apiGroupSuffix)
+}
+
 func validateNames(names *NamesConfigSpec) error {
 	missingNames := []string{}
 	if names.DefaultTLSCertificateSecret == "" {

internal/config/supervisor/config_test.go

@@ -64,6 +64,16 @@ func TestFromPath(t *testing.T) {
 			`),
 			wantError: "validate names: missing required names: defaultTLSCertificateSecret",
 		},
+		{
+			name: "apiGroupSuffix is prefixed with '.'",
+			yaml: here.Doc(`
+				---
+				apiGroupSuffix: .starts.with.dot
+				names:
+				  defaultTLSCertificateSecret: my-secret-name
+			`),
+			wantError: "validate apiGroupSuffix: 1 error(s):\n- a lowercase RFC 1123 subdomain must consist of lower case alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character (e.g. 'example.com', regex used for validation is '[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*')",
+		},
 	}
 	for _, test := range tests {
 		test := test