adjust rbac apiGroups to support core workloads api apps/v1

Without this access the logs of metrics-server will show the following error line:
```
unable to fully scrape metrics from source kubelet_summary:k8s-1: unable to fetch metrics from Kubelet k8s-1 (10.8.10.14): request failed - "403 Forbidden", response: "Forbidden (user=system:serviceaccount:kube-system:metrics-server, verb=get, resource=nodes, subresource=stats)",
```
and `kubectl top nodes` will give no results

When handling big Kubernetes objects, marshalling objects is memory
intense. This can be reproduced with the end-to-end test
`TestPrometheusRulesExceedingConfigMapLimit`. This patch doubles the
memory request and limit of the Prometheus Operator deployment to 100mb
and 200mb.

Configure kube-state-metrics

We default to a 30s scrapeInterval, we may as well also set scrapeTimeout to the same.

As requested, this updates the resource specification to live directly in config.kubeStateMetrics

It also clarifies the config variables. These names are what google uses in some of their tooling.

(And a slight tweak to the way collectors are specified)

* Make the Prometheus Operator Docker image run as `nobody` by default.
* Disallow privilege escalation via K8s
* Enforce read only root filesystem

As I work with kube-state-metrics in a large cluster, I found I needed to make some adjustments.

- Expose the collectors, allowing one to configure exclusions. 

- Expose the addon_resizer parameters, facilitating reproduce adjustments

- Allow adjusting scrapeTimeout and scrapeInterval

Allow settings custom tags of container images

[1] https://github.com/koalaman/shellcheck

*: Fix CRD generation

Make "Compiling" section easier to execute

kube-prometheus: Add kube-prometheus mixin to configure static etcd