Support mirroring of secrets into the gateway server namespace

Some users have brought up qualms about our current RBAC requirements (specifically around secrets). Currently we require:

- Controller: `create`, `delete` in all namespaces
- API Server: `get` in all namespaces
- Traefik: `get`, `list`, `watch` in all namespaces

The worry is around giving the ability to read secrets in all namespaces to pods. This affects the API Server (*Note that we don't give `list` or `watch` permissions, so the name of the secret would have to be known to read it*) and the Traefik proxy pods.

We don't rely on secrets for Traefik, but the implementation in Traefik gets grumpy if you disable this RBAC permission. An upstream fix would be needed, and I'm not likely to do that (if others do, please let me know and we can update our chart).

We can change the requirements for the API server though. While a dask cluster is active, the controller would ensure there was a mirrored copy of the secret in the same namespace as the API server. The API server would then only need `get` permissions for secrets in its own namespace. This adds some logic complications in the controller. The mirrored secrets also wouldn't have an parent objects, so their deletion would have to be handled explicitly in the controller.

I'm hesitant to make this change (as it complicates the codebase and uses more resources), but could if needed. If possible I'd like to make this optional, defaulting to the existing logic (no mirroring).