feat: add PSA compliance

[tylerslaton]

Summary

This PR brings Pod Security Admission (PSA) standards to RukPak in the form of updating the Namespace manifest (in accordance with the Kubernetes documentation) and Deployments.

Note: The namespace is running in a baseline model; However, we eventually want this to be restricted. For the time being I've implemented everything in such a way that restricted would be satisfied if we switch over except that the unpacker pod is running as root currently. This is because we cannot guarantee, at least at the moment, that the container image that we are going to unpack does not run as root. We'll need to think up a solution for this either here or in the future.

[joelanford]

We should also document somewhere that this change will require bundle image contents to be readable by the unpack pod, which may have an unpredictable process UID.

In general, we can probably say bundle files and directories should have GID=0 and they should have permissions 0750 and 0640 at a minimum.

[tylerslaton]

We should also document somewhere that this change will require bundle image contents to be readable by the unpack pod, which may have an unpredictable process UID.

@joelanford Is this a potential non-starter for things like the registry provisioner which is leveraging image content from pretty establish ecosystems? If I'm understanding correctly, that may require registry+v1 format Bundles to update file permissions.

[joelanford]

@tylerslaton, maybe that'll dictate that the registry provisioner runs in a separate namespace with less restrictive PSA (e.g. baseline)?

[joelanford]

As a follow-up, can we:

1. Add a knob to the image unpacker that lets a provisioner opt-in to the more restrictive security context stuff
2. Update the plain (and helm?) provisioners to use that knob
3. Update the tests and testdata for plain (and helm?) images to pass with the restrictive security contexts.
4. Update docs for the plain (and helm?) provisioners that talk about how bundle files need to be world-readable.

"And helm?" because I'm not sure what sort of file permissions Helm OCI images have.

[joelanford]

Just a minor nit about adding a TODO comment. Otherwise LGTM.

[anik120]

@tylerslaton I have a couple of clarifying questions otherwise looks good for the most part 🚀