feat: disable oauth2 client deletion

[David-Wobrock]

This new feature allows to disable hydra-maester OAuth2 client deletion. It can be a pitfall that, when a Kube CRD gets deleted, the OAuth2 client gets deleted too.

OAuth2 clients can be critical for production environments to work properly, and allowing to delete one when a Kubernetes CRD gets deleted has shown to be brittle for us. The CRDs are can be (temporarily) deleted for various reasons: human error, misconfiguration, etc.)
This feature should make hydra-maester safer.

Related Issue or Design Document

No issue or design document - it's an implementation attempt of a feature that we would find useful on hydra-maester :)

Checklist

• I have read the contributing guidelines and signed the CLA.
• I have referenced an issue containing the design document if my change introduces a new feature.
• I have read the security policy.
• I confirm that this pull request does not address a security vulnerability.
  If this pull request addresses a security vulnerability,
  I confirm that I got approval (please contact [email protected]) from the maintainers to push the changes.
• I have added tests that prove my fix is effective or that my feature works.
• I have added the necessary documentation within the code base (if appropriate).

Further comments

[Demonsthere]

I agree with your goal, but not the method of implementation. Imho a better solution would be to add a field to the CR deletionPolicy: Delete | Orphan with delete being the default option. Orhpan would allow for deleting the CR without client deletion.
wdyt? :)

[David-Wobrock]

I agree with your goal, but not the method of implementation. Imho a better solution would be to add a field to the CR deletionPolicy: Delete | Orphan with delete being the default option. Orhpan would allow for deleting the CR without client deletion. wdyt? :)

That would work too 👍 And more fine-grained, since it can be defined on a client-per-client basis.

I'll push some edits.