Docs for ci_job impersonation

Document ci_job impersonation based on https://gitlab.com/gitlab-org/cluster-integration/gitlab-agent/-/blob/master/doc/kubernetes_ci_access.md#impersonation.

• add the documentation to https://docs.gitlab.com/ee/user/clusters/agent/repository.html
• extend https://docs.gitlab.com/ee/user/clusters/agent/ci_cd_tunnel.html with a single paragraph on how users can restrict access rights, and point to the added documentation for details