Automatic merge from submit-queue

Add default cluster role bindings

Add default cluster roles bindings to rbac bootstrapping.  Also adds a case for allowing escalation when you have no authenticator.

@liggitt I expect you may need to make peace with this.