Disk encryption e2e tests ci cluster creation and tests

[rolandmkunkel]

Which issue this PR addresses:

Second part of:
https://msazure.visualstudio.com/AzureRedHatOpenShift/_workitems/edit/7404076

What this PR does / why we need it:

This PR adds tests for end-to-end disk encryption. When creating a cluster in CI or via local deployment, all data and OS disks are encrypted with customer-owned keys, which in case of our testing environment is either a shared key from the shared keyvault, or a generated one in case of CI. The tests in this PR make sure that the default storage class uses disk encryption, and that all OS disks are encrypted.

Is there any documentation that needs to be updated for this PR?

no, everything works under the hood

[github-actions]

Please rebase pull request.

[m1kola]

This solves work item 12050816. I assigned it to you.

[m1kola]

How does this work?

I see that in CI we create KV, key, disk encrpyiont set and they get deleted together with vnetResourceGroup.

When not in CI:

1. What is the experience with go run ./hack/cluster create?

   which in case of our testing environment is either a shared key from the shared keyvault, or a generated one in case of CI.

   Do I undersntad correctly that we use resources from the shared environemnt and only add Microsoft.KeyVault/vaults/accessPolicies? If so, I think there is mismatch in names between this PR and #1793. For example, key vault name is concat(take(resourceGroup().name,15), '-sharedKV') vs fmt.Sprintf("%s%s", vnetResourceGroup, sharedKeyVaultNameSuffix) in this PR.

2. What is the experience with go run ./hack/cluster delete?
   Do I understand correctly that we don't have to delete anything when not in CI because we use shared kv, key and disk encryption set?

[rolandmkunkel]

Regarding the questions:

1. You are correct, except for that access policies are not required to be set when using the shared environment. Access policies are only required on the disk encryption set for keys, which is taken care of while creating the environment. I fixed the name mismatch for the shared vault name.
2. Correct.

[m1kola]

I only have one question about condition for KV access policy (diskEncryptionKeyVaultAccessPolicy). Just double checking. If we actually don't need it - I'm happy to merge it as is.

Rest of the comments - let's create a small PR for them. These are 5 minutes changes and I don't want to hold this PR any longer becuase of them.

[m1kola]

Great job! I think this is ready to be merged once e2es are green 🎉

Reminder to myself: squash on merge.