chore(tests): add Kubernetes security requirements

[RealAnna]

All tests use the following container security settings:

• Capabilities.Drop: ALL
• ReadOnlyRootFilesystem: true
• AllowPrivilegeEscalation: false
• RunAsNonRoot: true
• RunAsUser: 10001
• RunAsGroup: 10001
• Privileged: false
• SeccompProfile.Type: runtimeDefault

Updates helm deployment

Add Check Yaml action

To add an exempt test you can match namespace and add a separate rule like I have done for hostmetrics

  # Exempt all matching resources in this namespace
      exclude:
        resources:
          namespaces:
            - e2ehostmetrics

[evan-bradley]

Nice, wouldn't have thought to use Kyverno here.

[evan-bradley]

Overall looks good to me.

Not looking to hold this up longer than necessary, so I'm approving it, but I think we could achieve the same thing using the Go stdlib template module and cut out the extra dependency.