[Story] Manage our own OAuthClient

In order to allow Cryostat to get a scoped token across additional namespaces, we can't use a Service Account as an OAuth client.

> I've been able to track down why the OAuth grant is failing for multiple namespaces.
>
> Here is the OAuthClient derived from the Service Account in namespace `c`:
>
> ```yaml
> metadata:
> name: system:serviceaccount:c:clustercryostat-sample
> additionalSecrets:
> -
> redirectURIs:
> - https://clustercryostat-sample-c.apps.example.com
> grantMethod: prompt
> scopeRestrictions:
> - literals:
> - user:info
> - user:check-access
> - user:list-scoped-projects
> - user:list-projects
> - clusterRole:
> roleNames:
> - '*'
> namespaces:
> - c
> allowEscalation: true
> ```
>
> This is the error from [ValidateScopeRestrictions](https://github.com/openshift/library-go/blob/7a65fdb398e28782ee1650959a5e0419121e97ae/pkg/authorization/scopemetadata/validation.go#L58) when trying to create a scoped token for namespaces `a`, `b`, and `c`:
>
> ```yaml
> error: '[role:cryostat-operator-oauth-client:a not found in [user:info user:check-access user:list-scoped-projects user:list-projects], role:cryostat-operator-oauth-client:a does not use an approved namespace, role:cryostat-operator-oauth-client:b not found in [user:info user:check-access user:list-scoped-projects user:list-projects], role:cryostat-operator-oauth-client:b does not use an approved namespace]'
> errorCauses:
> - error: '[role:cryostat-operator-oauth-client:a not found in [user:info user:check-access user:list-scoped-projects user:list-projects], role:cryostat-operator-oauth-client:a does not use an approved namespace]'
> errorCauses:
> - error: role:cryostat-operator-oauth-client:a not found in [user:info user:check-access user:list-scoped-projects user:list-projects]
> - error: role:cryostat-operator-oauth-client:a does not use an approved namespace
> - error: '[role:cryostat-operator-oauth-client:b not found in [user:info user:check-access user:list-scoped-projects user:list-projects], role:cryostat-operator-oauth-client:b does not use an approved namespace]'
> errorCauses:
> - error: role:cryostat-operator-oauth-client:b not found in [user:info user:check-access user:list-scoped-projects user:list-projects]
> - error: role:cryostat-operator-oauth-client:b does not use an approved namespace
> ```
>
> Looking at the OAuthClient, it has a scope restriction requiring the role scopes be in `c`. The [docs](https://docs.openshift.com/container-platform/4.12/authentication/using-service-accounts-as-oauth-client.html) indicate this is by design:
>
> > You can use a service account as a constrained form of OAuth client. Service accounts can request only a subset of scopes that allow access to some basic user information and role-based power inside of the service account’s own namespace
>
> It seems like in order to get a scoped token to work for multiple namespaces, we can't use the service account as an OAuth client. We would have to manage our own OAuthClient(s): https://docs.openshift.com/container-platform/4.12/authentication/configuring-oauth-clients.html#oauth-register-additional-client_configuring-oauth-clients.

_Originally posted by @ebaron in https://github.com/cryostatio/cryostat/issues/1188#issuecomment-1483219220_

Start with the OpenShift documentation on configuring OAuth clients and the linked ValidateScopeRestrictions implementation to understand the constraints described here. Trace how the operator currently relies on a service account as its OAuth client; done means the operator manages OAuthClient resources that allow scoped tokens across the required namespaces.

Written by the indexing model from the issue text.