Add audit log backend for impersonation proxy

Today: generate bare minimum of k8s audit events, but drop them

• Is this worth doing? This is a duplication of the actual API server audit logs.
• If it is worth doing, is the current implementation sufficient? Minimal events are captured currently.
• https://kubernetes.io/docs/tasks/debug-application-cluster/audit/

  • implement Audit policy?
    https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/#audit-k8s-io-v1-Policy

    First release: no. Implement a minimal set of events. Maybe the ability to turn auditing off.

  • implement log backend?
    Imma say no because of the complexity of matching existing K8s logging options.

  • implement webhook backend?
    Imma say yes because "more simple"

  • implement batching?
    First release: no. Implement a minimal set of events. Maybe the ability to turn auditing off.

  • implement parameter tuning?
    First release: no. Implement a minimal set of events. Maybe the ability to turn auditing off.

This was originally a TODO comment in impersonator.go from our initial implementation:

// TODO: wire up the real std out logging audit backend based on plog log level

The code currently uses Kubernetes audit hooks to get access to the authenticated identity (including before impersonation is performed). We might also want this code to emit a user-consumable audit log for the same reasons you might want it from kube-apiserver.

Start in impersonator.go at the TODO for wiring the standard output logging audit backend, then read the existing Kubernetes audit hooks and the linked Kubernetes audit documentation. The work is done when the project has a decided audit-backend scope and a corresponding implementation, including whether auditing can be disabled and which minimal events are emitted.