Add caching SecretsResolver/SecretsProvider

[alecthomas]

In production we use ASM to provide secrets, and we retrieve directly from it. This is costly and slow, especially for listing, so we should add a caching layer to the controller. The tricky bit is that we don't want to cache these results in the database because security, but with replicated controllers we'll need some solution to avoid every controller polling constantly.

One option might be for a single controller to perform the cache refreshing from ASM (holding a lease), and all other controllers redirect requests to that one for cache refreshes. We might need to extend leases to include an owner field (or more generically, metadata), that would contain the leader endpoint.

[alecthomas]

It also doesn't seem ideal that all secrets will be stored unencrypted in RAM in the controllers, @AlexSzlavik?