prod{access,vider}: implement

Prodaccess/Prodvider allow issuing short-lived certificates for all SSO
users to access the kubernetes cluster.

Currently, all users get a personal-$username namespace in which they
have adminitrative rights. Otherwise, they get no access.

In addition, we define a static CRB to allow some admins access to
everything. In the future, this will be more granular.

We also update relevant documentation.

Change-Id: Ia18594eea8a9e5efbb3e9a25a04a28bbd6a42153
diff --git a/tools/BUILD b/tools/BUILD
index e21744a..64faf53 100644
--- a/tools/BUILD
+++ b/tools/BUILD
@@ -20,3 +20,9 @@
     srcs = ["pass.py"],
     visibility = ["//visibility:public"],
 )
+
+copy_go_binary(
+    name = "prodaccess",
+    src = "//cluster/prodaccess:prodaccess",
+    visibility = ["//visibility:public"],
+)