Add preflight check implementation, add permission validation preflight check

[everettraven]

What this PR does / why we need it:

• Adds a flag (--preflight) to kapp deploy that can be used to enable/disable preflight checks. Can be used in the format --preflight=CheckName=true,...
• Adds a preflight check for permission validation that is disabled by default. Can be enabled with --preflight=PermissionValidation=true
  • For (Cluster)Roles it will ensure that a user has all the necessary permissions to create/update the resource without privilege escalation or has the "escalate" permissions
  • For (Cluster)RoleBindings it will ensure that a user has all the necessary permissions to create/update the resource without privilege escalation or has the "bind" permissions
  • For all other resources and operations, it will ensure it has the necessary permissions to perform the changes required by the change set

Which issue(s) this PR fixes:

Fixes #855

Does this PR introduce a user-facing change?

Adds `--preflight` flag to the `kapp deploy` subcommand. This flag can be used to enable/disable specific preflight checks and follows the format `--preflight=CheckName=true,...`

Adds a PermissionValidation preflight check, disabled by default, that can be enabled with `--preflight=PermissionValidation=true`

Additional Notes for your reviewer:

Review Checklist:

• Follows the developer guidelines
• Relevant tests are added or updated
• Relevant docs in this repo added or updated
• Relevant carvel.dev docs added or updated in a separate PR and there's
  a link to that PR
• Code is at least as readable and maintainable as it was before this
  change

Additional documentation e.g., Proposal, usage docs, etc.:

[praveenrewar]

Looks pretty good, thank you so much for putting in the effort @everettraven ❤️

I do want to double check my understanding on the different validations. We are trying to ensure that:

• User has permissions to create the resources that they want to create.
• For rbac resources, they should only be able to add the permissions that they currently have?

I didn't think of the second use case before, really glad that you have covered this as well 🙇🏻

[everettraven]

@praveenrewar I've updated the e2e tests to fix the CI failure. Checked that it passed locally with a fresh cluster this time around.

[praveenrewar]

LGTM! Thank you so much for working on this!!
@100mik I am keeping it open in case you are still taking a look.

[100mik]

LGTM! Thanks for the contribution ❤️

@everettraven we will need some documentation changes to carvel-dev/carvel around the --preflight flag. I do not think it should block this PR! However, we should make sure we have these in place before we push out a release.

[100mik]

I created a separate issue to track the required documentation changes 🙌🏼