Automatically create the container build SCC if containerBuildCapability is enabled

[l0rd]

Is your enhancement related to a problem? Please describe

Even if disableContainerBuildCapabilities: false an admin still requires to manually create a container-build SCC and grant privileges to get and update it to the DevWorkspace controller SA as mentioned here.

Describe the solution you'd like

We should introduce a new devEnvironments.containerBuildConfiguration section in CheCluster spec with the following defaults:

spec:
  devEnvironments:
    containerBuildConfiguration:
       openShiftSecurityContextConstraint: 'container-build'

When disableContainerBuildCapabilities: false then if the openShiftSecurityContextConstraint...

• ...doesn't exist: Che should create it and add a role binding to get and update it to the DevWorkspace controller SA.
• ...exists: Che should not override it, but should still add a role binding to get and update it to the DevWorkspace controller SA.

When disableContainerBuildCapabilities: true then if the openShiftSecurityContextConstraint:

• ...exists: Che should delete it along with the DevWorkspace controller SA role binding.
• ...doesn't exist: Che should do nothing.

If the SCC has been crated manually by the admin then Che should not delete it if disableContainerBuildCapabilities: true. For that when Che creates the SCC and the role bindings it should label them with app.kubernetes.io/managed-by: eclipse-che.