Support full namespaces as `source`
Currently on serviceaccounts are used to control the source, but other options are available and useful for applications:
- namespace
- notNamespace
- notPrincipals
- Principals
and should be supported for different use cases