docs(kustomize): revamp deployment guide, add RBAC and overlay improvements

[vbelouso]

• Rewrites the kustomize deployment guide with a structured deployment flow
• Removes exploit-iq-pull-secret from all manifests and documentation. Container images are hosted in a public quay.io organization and do not require an explicit pull secret
• Adds deployer-rbac.yaml with minimum RBAC for non-cluster-admin deployments, covering OAuthClient (scoped to exploit-iq-client and exploitiq-mcp-server resource names), anyuid SCC grants, and ServiceMonitor access
• Replaces oc get dns cluster with oc whoami --show-server | sed ... for deriving the OCP base domain. The DNS query requires cluster-admin
• Moves OIDC CA trust to a reusable Kustomize component (components/oidc-ca/). Clusters using untrusted or custom CA certificates on the OAuth endpoint (for example, ZeroSSL or enterprise PKI) can add the component to any overlay without modifying base manifests. Without this, OIDC JWKS fetch fails with a certificate path validation error at runtime
• Fixes self-hosted nginx overlay to include NGINX_UPSTREAM_NIM_EMBED preventing nginx startup failure when a dedicated embed NIM is not deployed
• Extracts all inline patches from kustomization.yaml to separate files and migrates patchesStrategicMerge to patches across all overlays. This prevents kustomize edit from mangling files when components are added, as the tool rewrites the entire file through its own YAML marshaller which destroys inline block scalars and YAML anchors
• Clarifies per-variant API key requirements, OAuth client secret minimum, cluster-admin requirements, and UI access group setup

[vbelouso]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[zvigrinberg]

GM @vbelouso ,
You did really good job, The oidc-ca certificate chain extraction and injection to deployment together with the corresponding configuration) should solve the problem of clusters using custom / untrusted OIDC certificates. ( also with the non production bypass for quick testing).
And off course, you streamlined the deployment process to be more clear, organized, and with less steps ( removed redundant steps) - It looks much better!.

Please see me comments!

[zvigrinberg]

@vbelouso Great Job!,
LGTM Approved.