Open challenges to limited testers

We should support / document how testers can try out a challenge without exposing it to the public.

The approach that works right now is to give the tester k8s access to the gcp project and have them run make port-forward.
However, this is not ideal since it gives access to all challenges. Maybe the access could be limited per namespace?

Alternatively, maybe we could support opening the challenges to certain IPs only?

- [ ] investigate best approach to make challenges available to testers only
- [ ] implement
- [ ] document