Make GC work also with RBAC

[mkmik]

Currently the GC does a pass through all the resource types
and performs a single cluster scoped list of all the objects.

This kind of requests is forbidden if the user has no rights list
every object of that type in all the namespaces.
When RBAC is configured, the user is likely to have at least one
namespace + resource type combination that they cannot list.

I tested this on a cluster with 4k objects in 12 namespaces,
and it was 2x slower on my slow ADSL (2m vs 1m before this patch).
That's bearable

But another cluster I have to use has 67 namespaces and it took
9m. That's tough.
There is no significant changes if by parallelizing by namespace.

Hence this change makes this new behavior optional and driven by flags:

1. --gc-list-mode: governs whether to use the current "cluster-scope",
   or the slower "per-namespace" mode.
2. --gc-ns-selector: allows users to only scan namespaces that match a
   given label selector. This is usually going to be some kind of team
   or project label that all namespaces associated with that user would
   have.

Unfortunately we cannot assume kubecfg can set the --gc-tag on the
namespaces objects it operates into, since they might not be writable by
users who have otherwise full control to all the other reasurces in it.

Closes #189

(also removes some dead code)

This PR doesn't add any tests. The existing code path for listing all resources for GC doesn't seem to have many tests either, so I'll shave this yak asynchronously.

[anguslees]

fyi, I added some tests for garbage collection just recently in #193

[anguslees]

I like the change generally. I don't like adding new flags to force onto the user what could be determined automatically.

I think we should either just always do per-namespace listing, or (better) try global and fall back to per-namespace if we get a permission error. (separately for each resource type - if they all fail, then it's only one extra RPC per resource type)

[mkmik]

I don't like adding new flags to force onto the user what could be determined automatically.

yeah it makes sense