[Multi-User] Deploy UI artifact service for each namespace

[Bobgy]

Design:

• UI fetches artifact with extra namespace parameter
• UI server proxies the artifact request to a ml-pipeline-ui-artifact service in each user's namespace
• The ml-pipeline-ui-artifact service uses user-namespace specific permissions, so different namespaces can have different permissions.

Work items:

• UI server should be able to proxy to services in different namespaces based on namespace query parameter: [UI] Multi user permission separation for artifact api #3522
• Deploy UI artifact service in each user's namespace Bobgy/manifests@42a782e
• Update metacontroller to 0.4.0 because A cluster-scoped controller cannot update or delete namespaced resources GoogleCloudPlatform/metacontroller#127 should better be solved for above change.
• Secure network access to namespaced UI artifact services by istio Bobgy/manifests@faf437d#diff-762b01268bcc6313528cc44fffc68e77R142 and Bobgy/manifests@2d0070d#diff-762b01268bcc6313528cc44fffc68e77L114

[Bobgy]

/cc @chensun

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[stale]

This issue has been automatically closed because it has not had recent activity. Please comment "/reopen" to reopen it.

[Bobgy]

All necessary tasks done. Metacontroller issue can be delayed.