Allow secret exports to filter the exportable fields

[cjnosal]

Describe the problem/challenge you have
I would like to export the ca.crt and tls.crt of a kubernetes.io/tls secret without exporting the private tls.key (or more generally, only export the public portion of asymmetric cryptography secrets, or an arbitrary subset of Opaque secrets).

Describe the solution you'd like
New optional fields in the SecretExport.spec (e.g. exportField, exportFields) to specify which portions of a secret to offer for export.

[cppforlife]

that seems like a good feature to have. though we may run into a validation problem for destinatino secret since some types require to have X keys present. (may be keep them empty?)

[cjnosal]

Yeah, for now we're using an opaque secret to only store the ca.crt, which is unfortunate.
kubectl create secret tls validates the key and cert are valid PEM files (with no CA arg), but kubectl apply will allow empty strings for tls.key/tls.crt.

Absent TLS-aware logic in the controller, a fully generic config might need to have include/exclude/truncate fields in the export?

Though I suppose there's the risk of a future k8s version / validating webhook with stronger opinions ...

[cppforlife]

related: #54

[neil-hickey]

@cppforlife did PR #54 fix the issue presented? Or shall I leave this one open?