Release v0.12.0

Release Image

Image	Registry
`projects.registry.vmware.com/pinniped/pinniped-server:v0.12.0`	VMware Harbor
`docker.io/getpinniped/pinniped-server:v0.12.0`	DockerHub

These images can also be referenced by their digest: sha256:767fbfa1c7064b07afc96139689240654c971dac319e7014e48ac721d014c7fd.

This is a bug fix release.

Fixed incorrect "readOnly" and "readOnlyRootFilesystem" field usage in Supervisor and Concierge deployment manifests, which was introduced in v0.11.0. This would cause installs using kubectl to fail with a validation error message. (#835)
Fixed a bug where the LDAP search base would become blank when the Active Directory bind secret was updated. (#836)
Fixed a bug with the selectors used on the Concierge Deployments and Services where they accidentally selected the Kube cert agent pod in addition to the expected pods. This could cause connection refused errors, or "the server is currently unable to handle the request" errors, for the Concierge API endpoints on some clusters. This bug would only appear on clusters which are configured to send requests to all pods which match the Service's selector, for example by performing round-robin request routing. A typical Concierge deployment has two Concierge pods and one Kube cert agent pod, resulting in one-third of the matching pods being wrong. (#839)

A complete list of changes (46 commits, 29 changed files with 1,304 additions and 203 deletions) can be found here.

Thanks to @JeremyCalcamuggio on Kubernetes Slack for quickly reporting the issue that was fixed by #835.