Add manualRules to tailoredProfile CRD

[Vincent056]

This PR enables users to disable automated checks on rules so that they can check those rules manually. They can do that by adding rules under manualRules in TailoredProfile Spec.
ex.

apiVersion: compliance.openshift.io/v1alpha1
kind: TailoredProfile
metadata:
  name: mod-node
spec:
  title: My modified profile with manual rules
  manualRules:
  - name: ocp4-kubelet-eviction-thresholds-set-soft-imagefs-available
    rationale: test
  description: test

[jhrozek]

First off, I'd like to hear from others what do they think. To expand on what's been requested -- some of our rules, for example those that check SCCs for being very privileged don't take into account customer customizations.

The SCCs example checks that there exists one SCC that allows all capabilities and its name is privileged. We've seen reports where the rule would fail because there are custom SCCs that are almost as privileged so they make the rule fail. One option we've offered so far was to tailor out the rule completely, but we've seen pushback on that as well because a tailored rule is "hidden" from the reports and doesn't prompt you to actually go and check the SCCs. A rule that returns MANUAL would.

So I'm OK with this approach personally, but because it touches the API, I'd like to hear from others, maybe there is a different solution. @mrogers950 @rhmdnd @JAORMX

[jhrozek]

Some nits inline, but the most important thing is to agree if we want to take this approach.

[jhrozek]

We should explicitly say that the remediations are not created in this case, both here and in the CRD docs.

[JAORMX]

I think the approach makes sense.

[jhrozek]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jhrozek, Vincent056

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [Vincent056,jhrozek]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

New changes are detected. LGTM label has been removed.

[Vincent056]

/retest

[Vincent056]

/retest

[Vincent056]

/retest