Introduce a new check for extension namespace configuration

[mateiidavid]

Linkerd's extension model requires that each namespace that "owns" an extension to be labelled with the extension name. Core extensions in particular strictly follow this pattern. For example, the namespace viz is installed in would be labelled with linkerd.io/extension=viz.

The extension is used by the CLI in many different instances. It is used in checks, it is used in uninstalls, and so on. Whenever a namespace contains a duplicate label value (e.g. two namespaces are registered as the owner of "viz") we introduce undefined behaviour. Extension checks or uninstalls may or may not work correctly. These issues are not straightforward to debug. Misconfiguration can be introduced due to a variety of reasons.

This change adds a new "core" category (linkerd-extension-checks) and a new checker that asserts all extension namespaces are configured properly. There are two reasons why this has been made a "core" extension:

• Extensions may have their own health checking library. It is hard to share a common abstraction here without duplicating the logic. For example, viz imports the healthchecking package whereas the multicluster extension has its own. A dedicated core check will work better with all extensions that opt-in to use linkerd's extension label.
• Being part of the core checks means this is going to run before any of the other extension checks do which might improve visibility.

The change is straightforward; if an extension value is used for the label key more than once across the cluster, the check issues a warning along with the namespaces the label key and value tuple exists on.

This should be followed-up with a docs change.

Closes #11509

---

Manual QA

Failure:

:; k get ns -l linkerd.io/extension=multicluster
NAME                   STATUS   AGE
linkerd-multicluster   Active   23h
default            

kubernetes-api
--------------
√ can initialize the client
√ can query the Kubernetes API

linkerd-webhooks-and-apisvc-tls
-------------------------------
√ proxy-injector webhook has valid cert
√ proxy-injector cert is valid for at least 60 days
√ sp-validator webhook has valid cert
√ sp-validator cert is valid for at least 60 days
√ policy-validator webhook has valid cert
√ policy-validator cert is valid for at least 60 days

linkerd-version
---------------
√ can determine the latest version
‼ cli is up-to-date
    unsupported version channel: dev-78a5ec56-matei
    see https://linkerd.io/2/checks/#l5d-version-cli for hints

...

linkerd-extension-checks
------------------------
‼ namespace configuration for extensions
    some extensions have invalid configuration:
        * label "linkerd.io/extension=multicluster" is present on more than one namespace:
                * linkerd-multicluster
                * default
        * label "linkerd.io/extension=viz" is present on more than one namespace:
                * test
                * test2
    see https://linkerd.io/2/checks/#l5d-extension-namespaces for hints


linkerd-multicluster
--------------------
√ Link CRD exists
√ Link resources are valid
        * target

Status check results are √

Success:

:; k label ns default linkerd.io/extension=m --overwrite
namespace/default labeled

linkerd-extension-checks
------------------------
√ namespace configuration for extensions

linkerd-multicluster
--------------------
√ Link CRD exists
√ Link resources are valid
        * target
√ remote cluster access credentials are valid
        * target
√ clusters share trust anchors
        * target
√ service mirror controller has required permissions
        * target

Alternatives

• We could fail the check instead of issuing a warning

[alpeb]

Looks good to me, modulo lint issue 👍