Design, implement, and validate the security model

[TomAugspurger]

Our security model can be roughly defined as "users can do whatever they want in their namespace, and nothing outside of it".

We should

1. Make that definition a bit more precise (does whatever they want include starting services, creating / mounting volumes, etc.? Or do we limit it just to Jobs? Jobs with certain properties (only one container, no unknown volumes, ...)?)
2. Verify that it's a reasonable way to handle "multi-tenant" Kubernetes clusters, where one user shouldn't be able to see or modify another user's jobs / pods / etc.
3. Actually implement it