Currently, the same etcd user (i.e., remote) is granted permissions to
read the whole content of the clustermesh-apiserver's sidecar etcd
instance, including also the data cached by kvstoremesh, when enabled.
In an effort to harden the overall clustermesh posture, let's introduce
a separate and dedicated user for local access, to ensure that remote
clusters cannot access cached data, as it may include information that
they would not normally have access to.

Specifically, the remote user is intended to have access only to the
information regarding the local cluster, while the local user can
access cached data about remote clusters only. Still, for backward
compatibility purposes, the remote user still retains access to cached
data as well in this release. The reason being that there would
otherwise be a time window upon upgrade in which Cilium Agents would
lose access to the kvstoremesh data (especially in large clusters).
Indeed, the new certificate would be mounted by the agents only upon
rollout, but the configuration would be immediately reloaded (thus
targeting the new, not yet mounted, certificate), hence breaking the
access to the information cached by kvstoremesh.

Signed-off-by: Marco Iorio <marco.iorio@isovalent.com>