Get rid of get secrets permission of dashboard client

[petersutter]

What would you like to be added:
The get secrets permission of the dashboard client (which is "almost" as powerful as having the cluster-admin permission) is required for:

• Terminal bootstrapping logic
• Show monitoring credentials for project viewer #943

dashboard/charts/gardener-dashboard/charts/application/templates/clusterrole.yaml

Lines 63 to 69 in 79703af

	# required for terminal bootstrapping and gardener/dashboard#943
	- apiGroups:
	- ""
	resources:
	- secrets
	verbs:
	- get

To get rid of the get secret permission we need to solve

• Factor out terminal bootstrapping #748
• Enable access to display cluster monitoring data for project members with "Viewer" permissions monitoring#11
• Display OIDC observability URLs #1899
• Remove https://github.com/gardener/gardener/blob/5ed6ddbc750d160e818c4d6781bf609d6944ddf6/pkg/component/gardener/dashboard/rbac.go#L65-L69 for Dashboard version 1.76.0 Adapt gardener-dashboard component gardener#10572

Why is this needed:

[vlerenc]

Out of curiosity: Isn't the title somewhat misleading? The dashboard will always require permissions to read and write (cloud provider) secrets, but in that case (different than viewers), it's done with the end user token or what's the (current) state?

[petersutter]

yes correct. We always use the users token to read / write cloud provider secrets, but to read the monitoring secret we take the dashboard user https://github.com/gardener/dashboard/blob/master/backend/lib/services/shoots.js#L317-L324
I have updated the title accordingly so that it is clear that I'm talking about the dashboard client.

[petersutter]

/close all tasks done