feat: k8s connector: allow disabling provider-name prefixing on users

[ssoroka]

Summary

See #1367. allow disabling prefixing of user emails in k8s. okta:joe@example.com to become joe@example.com. Assists with users managing their own authorization.

Checklist

• Wrote appropriate unit tests
• Considered security implications of the change
• Updated associated docs where necessary
• Updated associated configuration where necessary
• Change is backwards compatible if it needs to be (user can upgrade without manual steps?)
• Nothing sensitive logged
• Commit message conforms to Conventional Commit
• GitHub Actions are passing
• Considered data migrations for smooth upgrades

Related Issues

Resolves #1367

[mxyng]

Can potentially remove prefixing entirely. It was originally added to differentiate infra-created [cluster] role bindings from existing [cluster] role bindings. Since that's no longer necessary, removing it should be a consideration.

[jmorganca]

Not sure we'd want to add a flag here since the user will need to know to do this for every connector. Wouldn't it make more sense to just remove infra:<provider> from the impersonation header?

On second thought, should we just remove the prefixes altogether? We don't add them for groups right now, and while it's an extra layer of security we may want to instead revisit this with #1286