How to categorize this PR?

/area security
/kind enhancement

What this PR does / why we need it:
gardener-operator creates kube-system/gardener-apiserver Service and kube-system/gardener-apiserver Endpoint in the virtual cluster:

• gardener/pkg/component/gardener/apiserver/service.go

  Lines 42 to 59 in 485c251

  	func (g *gardenerAPIServer) service() *corev1.Service {
  	return &corev1.Service{
  	ObjectMeta: metav1.ObjectMeta{
  	Name: serviceName,
  	Namespace: metav1.NamespaceSystem,
  	Labels: GetLabels(),
  	},
  	Spec: corev1.ServiceSpec{
  	Type: corev1.ServiceTypeClusterIP,
  	Selector: GetLabels(),
  	Ports: []corev1.ServicePort{{
  	Port: servicePort,
  	Protocol: corev1.ProtocolTCP,
  	TargetPort: intstr.FromInt32(port),
  	}},
  	},
  	}
  	}

• gardener/pkg/component/gardener/apiserver/endpoints.go

  Lines 12 to 29 in 485c251

  	func (g *gardenerAPIServer) endpoints(clusterIP string) *corev1.Endpoints {
  	return &corev1.Endpoints{
  	ObjectMeta: metav1.ObjectMeta{
  	Name: serviceName,
  	Namespace: metav1.NamespaceSystem,
  	Labels: GetLabels(),
  	},
  	Subsets: []corev1.EndpointSubset{{
  	Ports: []corev1.EndpointPort{{
  	Port: servicePort,
  	Protocol: corev1.ProtocolTCP,
  	}},
  	Addresses: []corev1.EndpointAddress{{
  	IP: clusterIP,
  	}},
  	}},
  	}
  	}

• gardener/pkg/component/gardener/apiserver/apiserver.go

  Lines 193 to 206 in 485c251

  	virtualResources, err := virtualRegistry.AddAllAndSerialize(
  	g.apiService(secretCAGardener, gardencorev1.SchemeGroupVersion.Group, gardencorev1.SchemeGroupVersion.Version),
  	g.apiService(secretCAGardener, gardencorev1beta1.SchemeGroupVersion.Group, gardencorev1beta1.SchemeGroupVersion.Version),
  	g.apiService(secretCAGardener, seedmanagementv1alpha1.SchemeGroupVersion.Group, seedmanagementv1alpha1.SchemeGroupVersion.Version),
  	g.apiService(secretCAGardener, operationsv1alpha1.SchemeGroupVersion.Group, operationsv1alpha1.SchemeGroupVersion.Version),
  	g.apiService(secretCAGardener, settingsv1alpha1.SchemeGroupVersion.Group, settingsv1alpha1.SchemeGroupVersion.Version),
  	g.apiService(secretCAGardener, securityv1alpha1.SchemeGroupVersion.Group, securityv1alpha1.SchemeGroupVersion.Version),
  	g.service(),
  	g.endpoints(serviceRuntime.Spec.ClusterIP),
  	g.clusterRole(),
  	g.clusterRoleBinding(secretVirtualGardenAccess.ServiceAccountName),
  	g.clusterRoleBindingAuthDelegation(secretVirtualGardenAccess.ServiceAccountName),
  	g.roleBindingAuthReader(secretVirtualGardenAccess.ServiceAccountName),
  	)

However, gardener admins currently don't have permissions to inspect or mutate these resources.

Which issue(s) this PR fixes:
N/A

Special notes for your reviewer:
I don't know at all what is the use case of these Service and Endpoint. Let me know if they are not used. Let me know also what is their use case - it would be interesting to learn this.
EDIT: The APIService points to the kube-system/gardener-apiserver Service. The underlying Endpoint resolves to the clusterIP of the garden/gardener-apiserver Service in the runtime cluster.

Release note:

Gardener administrators are now allowed to inspect and manage Services and Endpoints in the garden cluster.