Move Cloud Events publishing into a separate controller binary

Feature request

Move the controller logic that currerntly watches for {Task,Pipeline}Run updates and emits Cloud Events into a separate controller binary, that is released and installed by default alongside the rest of the Tekton components.

Use case

This should make Cloud Events publishing separately configurable, monitorable and scalable, and in cases where an operator or distributor wants to disable Cloud Events publishing completely, they can do so by just removing the Deployment for the Cloud Event publishing controller.

This also has security implications, since the Cloud Events publishing controller can run as a service account with read-only access to {Task,Pipeline}Runs and their /status subresource. If the controller is compromised, an attacker wouldn't also have read/write access to all secrets in the cluster, as the main Tekton controller has today.

This also provides an example of separating logic from the main controller binary, which may be illustrative for other future integrations which are both first-party (owned by Tekton) and might be optional for operators.