[SURE-8270] Gitjob controller security context

[manno]

The fleet-controller and fleet-agent dissallow privilege escalation and use a read only filesystem. Gitjob controller should do the same.

• https://github.com/rancher/fleet/blob/main/charts/fleet/templates/deployment.yaml#L172-L178
• https://github.com/rancher/fleet/blob/main/charts/fleet-agent/templates/deployment.yaml#L30-L36

See https://github.com/rancher/fleet/blob/main/charts/fleet/templates/deployment_gitjob.yaml
We will need to add empty dirs for the writablel directories.

These must be disabled in debug mode, so we can attach debuggers and profilers.

[thardeck]

QA Template

Solution

Add additional security restrictions to the Gitjob deployment without any noticeable impact on the usage.

Testing

• Verify that polling of git repos work fine (Optional verify different git setups, like e.g. ssh, ssh with known hosts)
• Run a fleet upgrade from a previous Fleet version with a working git repo and make sure that polling works fine afterwards
• Verify that the upgraded gitjob configuration has the additional security permissions