The BreakglassSession CRD should contain idle timeout and last used fields.

[bazko1]

To be reconsidered if required and if could be handled in some smart tricky manner.

Feature description:

• Breakglass system operators would like to have an insight when specific session group was last time used.
• Approved session (group) that was not used for defined period of time should be revoked for new approval procedure.

Blocks:

• k auth can-i allows multiple groups checks (multiple --as-group params) so we can perform single check for all BreakglasSessions this limits number of RBAC check calls, but if access in approved we do not know specifically which group
• Without this feature the webhook call could only trigger read operation on BreakglassSession CRDs this will force to perform write and update CRD status.