Audit policy metadata-only rule should include serviceaccounts/token resource

[liggitt]

The following files reference a metadata-only audit policy in order to prevent logging request/response contents for sensitive resources:

• https://github.com/opsnull/follow-me-install-kubernetes-cluster/blob/master/05-2.apiserver%E9%9B%86%E7%BE%A4.md

A recent Kubernetes bugfix means that audit-logging of subresource requests which previously failed will now log successfully. The serviceaccounts/token subresource responds to TokenRequest API calls with a newly minted service account token.

The serviceaccounts/token resource should also be included in the metadata-only audit policy if credentials are not intended to appear in the audit log:

      - group: ""
        resources:
          - secrets
          - configmaps
          - serviceaccounts/token