GitLab

Add PSP and related role/rolebinding/SA resources to logging chart.
The PSP contains restricted rules + hostPath volume.
Also, remove unnecessary privileged escalation from log-aggregator.

Note:
See https://kubernetes.io/blog/2019/07/18/api-deprecations-in-1-16/
- PSP is introduced in policy apigroup in 1.10, and removed from extensions apigroup in 1.16.
- DaemonSet, Deployment, StatefulSet, and ReplicaSet migrate to apps in 1.9, and no longer be served from extensions in 1.16
- Ingress is migrated to networking.k8s.io in 1.14, and will be removed from extensions in 1.18

Problem:
Fail to enable monitoring on restricted PSP clusters.

Solution:
1. Update grafana to run as grafana user.
2. Update nginx sidecars to run as nginx user, move files to the user
home directory(/var/cache/nginx) and listen on non privileged 8080 port.
With 1 & 2, project monitoring works in restricted clusters out of the
box.
3. Add necessary PSP/role/rb resource to node-exporter, which is used by
cluster monitoring.