This patch refactors the entire ingress setup into two ingress classes:
internet and intranet. This allows to ensure that they use separate
services, reduces the attack surface and enables the usage of
external-dns.

This patch adjusts the component for oauth2-proxy to also include a
patching mechism for all kustomize-defined Ingress objects to be
restricted.