Gardener: Replace the `use-as-seed` annotation with a `spec` field

[rfranzke]

What would you like to be added:
In order to mark shoots to be used as seed we have the shoot.gardener.cloud/use-as-seed annotation. It allows a historically grown, meanwhile awkward, comma-separated list of options.
Let's replace this annotation with a field in the ShootSpec where we embed the SeedSpec and which will allow to set/control every field of the seed configuration:

---
apiVersion: core.gardener.cloud/v1beta1
kind: Shoot
metadata:
  name: crazy-botany
  namespace: garden-dev
spec:
  secretBindingName: my-provider-account
  cloudProfileName: cloudprofile1
  region: europe-central-1
  shootedSeed:
    metadata:
      labels:
        foo: bar
    spec:
      provider:
        providerConfig:
          foobar
      taints:
      - key: seed.gardener.cloud/protected  
  ...

The .spec.shootedSeed field should probably be of runtime.RawExtension so that the OpenAPI generation is bypassed. Otherwise, if we would simply inline the SeedSpec, several fields would be required to set which don't make sense to set in the shooted-seed case. The other option, not preferred option, is to duplicate the SeedSpec and make all fields optional.

It should only be possible to set this field if the Shoot's namespace is garden.

Why is this needed:
Cleaner and easier configuration.

/kind cleanup

[timebertt]

/touch

In a chat with @gardener/gardener-maintainers, @vpnachev proposed to have a dedicated resource (e.g. ShootedSeed) which will contain a reference to the Shoot and the Seed template.
We could also add another section in this resource, which configures the gardenlet deployment, for example which bootstrap mechanism to use (bootstrap token / service account) but also (parts of) the GardenletConfiguration.

This would allow us to fine-tune the Seed and gardenlet config of shooted seeds in order to deviate from the global defaults, e.g. lower the concurrent sync for one seed or enable a feature gate only on specified seeds (which will probably help with testing and graduating feature gates more easily).
Also, this will probably simplify the deletion protection of shooted seeds a bit.

/cc @HerrmannHinz

[timebertt]

We might even think about making the resource namespaced and then register ShootedSeeds in the garden namespace as "globally" available Seeds and ShootedSeeds in a project namespace will automatically receive project specific taints and labels, so that Shoots of the project can use "private Seeds".
/cc @vlerenc

[dguendisch]

Good idea! Sounds like it would help the colleagues currently writing control plane migration tests as well!
/cc @plkokanov @kris94

[plkokanov]

Yep that would greatly help to isolate the test seeds, would also allow us to actually have integration tests for bootstrapping seeds (independent of CP migration).

[vlerenc]

@timebertt Yes, new functionality should already consider the private cloud profiles/seeds requirements in https://github.com/gardener/gardener/issues/2874. Eventually we will have to turn around our current non-namespaced seeds, which will help @plkokanov and for other tests.

To do the right thing though, it would be best to start first with a GEP as @danielfoehrKn suggested.