Automatic merge from submit-queue (batch tested with PRs 40345, 38183, 40236, 40861, 40900)

refactor approver and signer interfaces to be consisten w.r.t. apiserver interaction

This makes it so that only the controller loop talks to the
API server directly. The signatures for Sign and Approve also
become more consistent, while allowing the Signer to report
conditions (which it wasn't able to do before).