Add secured namespaces possibility

[ThomasCAI-mlv]

I propose the concept of secured namespaces.
The idea is to add an extra layer of security to protect sensitive data produced by given namespaces, so that only a secured namespace can consume data from another secured namespace. The basic namespaces will not be able to consume data produced by secured namespaces.

In ns4kafka, this protection will be at the ACL level:

• ✅ Secured namespace can grant ACL to another secured namespace
• ❌ Secured namespace cannot grant ACL to a basic namespace
• ✅ Basic namespace can grant ACL to a secured namespace
• ✅ Basic namespace can grant ACL to another basic namespace
• ❌ Secured namespace cannot create public ACL (giving access to all other namespaces of the cluster)

Other info:

• Namespaces are considered secured if their config spec.secured is true
• Namespaces will be basic by default.
• For Michelin D2 data use case, it would provide an extra security in addition to the usage of Oauth2 (which replaces basic auth).

Instead of secured, we can use the name guarded, limited, or restricted. What do you think?

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[ThomasCAI-mlv]

I put this additional condition !granteeIsPublic, because when the ACL is granted to *, getNamespace("*") will fail.

Feel free to challenge if you think there is a prettier way to forbid secured namespaces granting ACL to all or to basic namespaces.