CI audit logging is insuffcient

CI audit logging should capture full body of all pinniped CR instances and should capture all non-secret mutations caused by the pinniped controllers.

We currently only record metadata which makes it hard to debug certain failures:

apiVersion: audit.k8s.io/v1
kind: Policy
# Don't generate audit events for all requests in RequestReceived stage.
omitStages:
- "RequestReceived"
rules:
# Don't log requests for events
- level: None
  resources:
  - group: ""
    resources: ["events"]
# Don't log authenticated requests to certain non-resource URL paths.
- level: None
  userGroups: ["system:authenticated", "system:unauthenticated"]
  nonResourceURLs:
  - "/api*" # Wildcard matching.
  - "/version"
  - "/healthz"
  - "/readyz"
# A catch-all rule to log all other requests at the Metadata level.
- level: Metadata
  # Long-running requests like watches that fall under this rule will not
  # generate an audit event in RequestReceived.
  omitStages:
  - "RequestReceived"

xref: #348 #806

Start by reviewing the audit.k8s.io/v1 Policy shown in the issue and the referenced issues #348 and #806. Trace how Pinniped controllers mutate Pinniped custom resources and how audit policy rules apply to those requests. Done means audit records include full non-secret CR bodies and non-secret controller mutations without recording secrets.