[cmd] Implement a rootless deprecation messages

[charlieegan3]

I have added a system for showing fatal and non-fatal deprecation warnings. It's configurable by command and environment.

If we merge this PR, running a rootless image with any OPA command other than opa run will result in a fatal error and exit code 1.

It's possible for users to continue to use the image by unsetting: OPA_DOCKER_IMAGE_TAG=rootless.

opa run will show the message, but it's not fatal for this command. This is intended to avoid production disruption.

This PR has been added to allow us to one day do #6086. It is a simpler version of my earlier PR for the same task #5566.

Example showing how opa build will fail and exit with 1:

opa $ OPA_DOCKER_IMAGE_TAG=rootless go run main.go build
################################################################################
###                        FATAL DEPRECATION WARNINGS                        ###
################################################################################
OPA appears to be running in a deprecated -rootless image.
Since v0.50.0, the default OPA images have been configured to use a non-root
user.

This image will soon cease to be updated. The following images should now be
used instead:

* openpolicyagent/opa:latest and NOT (openpolicyagent/opa:latest-rootless)
* openpolicyagent/opa:edge and NOT (openpolicyagent/opa:edge-rootless)
* openpolicyagent/opa:X.Y.Z and NOT (openpolicyagent/opa:X.Y.Z-rootless)

You can choose to acknowledge and ignore this message by unsetting:
OPA_DOCKER_IMAGE_TAG=rootless
################################################################################
###                      END FATAL DEPRECATION WARNINGS                      ###
################################################################################
exit status 1

Example showing how opa run will continue as normal, after showing the message.

$ OPA_DOCKER_IMAGE_TAG=rootless go run main.go run -s
################################################################################
###                           DEPRECATION WARNINGS                           ###
################################################################################
OPA appears to be running in a deprecated -rootless image.
Since v0.50.0, the default OPA images have been configured to use a non-root
user.

This image will soon cease to be updated. The following images should now be
used instead:

* openpolicyagent/opa:latest and NOT (openpolicyagent/opa:latest-rootless)
* openpolicyagent/opa:edge and NOT (openpolicyagent/opa:edge-rootless)
* openpolicyagent/opa:X.Y.Z and NOT (openpolicyagent/opa:X.Y.Z-rootless)

You can choose to acknowledge and ignore this message by unsetting:
OPA_DOCKER_IMAGE_TAG=rootless
################################################################################
###                         END DEPRECATION WARNINGS                         ###
################################################################################
{"addrs":[":8181"],"diagnostic-addrs":[],"level":"info","msg":"Initializing server. OPA is running on a public (0.0.0.0) network interface. Unless you intend to expose OPA outside of the host, binding to the localhost interface (--addr localhost:8181) is recommended. See https://www.openpolicyagent.org/docs/latest/security/#interface-binding","time":"2023-07-13T14:24:07+01:00"}

[srenatus]

LGTM 🥳 Nicely done.

[srenatus]

Oooh I didn't know that cobra.Command had that 💡

[ashutosh-narkar]

LGTM. Thanks for looking into this! Please squash and merge!