Automatic merge from submit-queue

add user.Info.GetExtra

I found myself wanting this field (or something like it), when trying to plumb the information about which scopes a particular token has.

Only the token authenticators have that information and I don't want tokens to leak past the authenticator.  I thought about extending the `authenticator.Token` interface to include scopes (`[]string`), but that felt a little specific for what I wanted to do.  I came up with this as an alternative.

It allows the token authenticator to fill in the information and authorizers already get handed the `user.Info`.  It means that implementors can choose to tie the layers together if they wish, using whatever data they think is best.  

@kubernetes/kube-iam