generate minimal config during installation

[wasaga]

Summary

Since v0.22.0 IdP setup is not required for startup, and may be omitted to use hosted authenticate service.

That means the one-time job that generates initial bootstrap secrets may also generate a functional global config CRD in form:

apiVersion: ingress.pomerium.io/v1
kind: Pomerium
metadata:
  name: global
spec:
  secrets: pomerium/bootstrap

TODO: needs a bit of testing as we still may need to wait until CRD is created and recognized by the cluster though, as this job runs concurrently with CRD installation.

Related issues

Checklist

• reference any related issues
• updated docs
• updated unit tests
• updated UPGRADING.md
• add appropriate tag (improvement / bug / etc)
• ready for review