Namespace allocators should probably be moved to an external controller

The namespace UID allocators depend on direct access to etcd (for their allocation map) and aren't structured like a classic controller.

While allocation should happen on creation (i.e. making it like an initializer), it should also happen if the user clears the annotation, so I don't think this really has to be an initializer to be successful (although I worry that we possibly might want to fail closed, if RunAsRange doesn't).

To move to a controller, we need an API resource that can handle opaque bit ranges, and we need to think about how this would be exposed securely. I.e. a global cluster scoped allocation resource sucks because you might want controllers to be able to use it. ConfigMaps suck because you'd generate a brazillian writes and because they're not binary so we'd have to base64 encode them. TPR don't work because we don't have protobuf storage for them.

Upstream we need to refactor Service allocation controller to be an initializer (although it's an open question whether doing that makes services less available, because you can't have a service until it gets allocated, but if the controller itself depends on services, etc) and it also needs a range resource.