Add revoke action and YAML support for permission updates

[anniegracehu]

Summary

• add revoke action to provider-kubeconfig.py
• support both JSON and YAML permission files for update and revoke
• keep <sa>-perms configmap synchronized when updating and revoking permissions
• add tests for revoke CLI validation and permission file parsing
• add manual YAML fixture for update/revoke e2e at tests/manual/update-revoke-perms.yaml

Test plan

• python3 -m unittest tests/test_provider_kubeconfig.py

Manual update/revoke e2e (existing SA)

Use an existing service account (example: argocd-application-controller in argocd) and verify update/revoke without creating a new SA.

# Inputs
NS=default
SA=default
KCFG="$HOME/.kube/config"
PERMS=tests/manual/update-revoke-perms.yaml

# 1) Baseline (expected: no)
kubectl auth can-i create secrets -n "$NS" --as=system:serviceaccount:$NS:$SA --kubeconfig="$KCFG"

# 2) Grant via update (expected: yes)
python3 provider-kubeconfig.py update "$NS" -c "$SA" -p "$PERMS" -k "$KCFG"
kubectl auth can-i create secrets -n "$NS" --as=system:serviceaccount:$NS:$SA --kubeconfig="$KCFG"

# 3) Revoke (expected: no)
python3 provider-kubeconfig.py revoke "$NS" -c "$SA" -p "$PERMS" -k "$KCFG"
kubectl auth can-i create secrets -n "$NS" --as=system:serviceaccount:$NS:$SA --kubeconfig="$KCFG"