Security : move away from "cluster-admin" everywhere

Currently, `Onyxia-api` do everything (both `kubectl` and `helm`) using a single service account that is supposed to be cluster-admin.
Here are some improvements we could make :
* [x] Every regular `kubectl` and `helm` calls should be made using user's permissions
* [ ] Onboarding (creating user's namespace, applying permissions ...) should be done using a separate service account and preferably done in another process / pod (externalize the onboarding process as a standalone API ?)
* [ ] Try to reduce or at least refine and explicit permissions needed for the onboarding feature. Currently, it defaults to creating a cluster-admin service account which is probably too much

Start by tracing the Onyxia-api paths that make kubectl and helm calls and the onboarding flow that creates namespaces, permissions, and service accounts. Map the current cluster-admin dependency first; done means onboarding uses a separate identity and its required permissions are explicitly reduced or refined.

Scritto dal modello di indicizzazione a partire dal testo della issue.