[kong] add read-only root filesystem option

[rainest]

What this PR does / why we need it:

Adds an option to control enforcing read-only root filesystem in the PodSecurityPolicy.

Special notes for your reviewer:

Prior work in helm/charts#19663

• The issue where Enterprise wrote to root regardless of its prefix will be addressed in 1.5 (see FTI-1163 for internal discussion). Manual testing of upgrades and fresh installs of 1.5 preview builds confirmed that the issue is clear.
• The second issue with the container image no longer appears to be present. I was not able to reproduce it with either core 1.5, core 2.0, or Enterprise 1.5.
• The Postgres sub-chart does not play well with PSP automation, and requires creating a PSP independent of the chart (Bitnami does not provide a stock policy). It cannot reuse the ServiceAccount we create for Kong, as it both requires a writeable root filesystem and access to PVCs.

Checklist

[Place an '[x]' (no spaces) in all applicable fields. Please remove unrelated fields.]

• PR is based off the current tip of the next branch and targets next, not master
• New or modified sections of values.yaml are documented in the README.md
• Title of the PR and commit headers start with chart name (e.g. [kong])

[hbagdi]

I'm all for making this configurable but setting the default to true seems to be unacceptable at this point.

The Postgres sub-chart does not play well with PSP automation, and requires creating a PSP independent of the chart (Bitnami does not provide a stock policy). It cannot reuse the ServiceAccount we create for Kong, as it both requires a writeable root filesystem and access to PVCs.

We don't need to worry about Postgres sub-chart. Our stand should be to bring your own db when it comes to using this chart whenever anyone wants to do anything more than what the existing chart provides.

[hbagdi]

Since this is not compatible with 1.3, we can't put this in as a default.
1.5 is not even GA at this point.

[rainest]

Agree that we should hold this until 1.5 is out, but are we concerned with having it be the default then? It still only applies to users that have specifically enabled PSPs.

Worst case users already have it enabled and don't read the upgrade guide. Their GUI will be broken because it can't write its config, while the proxy and admin API will function normally, so fairly minor impact.

[hbagdi]

Discussed offline with Travis that the blast radius here is very small and we can take a chance with RO Root FS to be true.