prow: switch cncf-ci-github-token to ExternalSecret

[spiffxp]

Migrate the cncf-ci-github-token Kubernetes Secret used by the ci-k8sio-audit job to an ExternalSecret.

This let me uncover a few things:

• we didn't have prow-build-trusted setup the same way as prow-build for access
• we didn't have a kubernetes-external-secrets service account setup
• move to a {namespace}-{resource}.yaml convention for serviceaccounts and externalsecrets

Everything here has already been deployed

I exercised by changing the secret value to "monkeys" and seeing the change reflected in-cluster, before changing back.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: spiffxp

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [spiffxp]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[spiffxp]

Migrating secrets ref: #2220

[ameukam]

/lgtm