Configure manager to properly impersonate when communicating with managed clusters

[caseydavenport]

Description

tigera-manager needs to be configured with a tenant namespace so that it
can query managed clusters properly in a multi-tenant environment, and
to indicate that it should be using impersonation when talking to
managed clusters via Voltron.

In order to enable that flow, we must also grant
tigera-manager:tigera-manager permissions to "get" managed clusters
in order to pass Voltron's authorization checks.

For PR author

• Tests for change.
• If changing pkg/apis/, run make gen-files
• If changing versions, run make gen-versions

For PR reviewers

A note for code reviewers - all pull requests must have the following:

• Milestone set according to targeted release.
• Appropriate labels:
  • kind/bug if this is a bugfix.
  • kind/enhancement if this is a a new feature.
  • enterprise if this PR applies to Calico Enterprise only.