fix: security pipeline issues

[RealAnna]

closes #687
closes #678
closes #628
closes #699
closes #717

Adds cert manager to the security pipeline

Modify security pipeline to run from branch images if triggered manually

Also addresses agreed changes from this run

• Fix Service Does Not Target Pod
• Fix Root Container Not Mounted Read-only when applicable (Cert-mgn) ignore for operator
• Ignore ns quota Pod or Container Without ResourceQuota,
• Ignore ns quota Pod or Container Without LimitRange
• Investigate and let the team know what AppArmor is (looks like introduced in beta in v1.4) Missing AppArmor Profile
• Fix ready-health probes in kube-rbac-proxy, if it has the probes Liveness Probe Is Not Defined && Readiness Probe Is Not Defined
• Separate issue - digest as part of img Image Without Digest (see Image Without Digest #720)
• Create a ticket to add imgpullpolicy as Helm flag Image Pull Policy Of The Container Is Not Set To Always ( see Make Image Pull Policy configurable via Helm value #721)
• Disable limit=request (Container Requests Not Equal To It's Limits)
• Ignore secret read ServiceAccount Allows Access Secrets
• Ignore secret read RBAC Roles with Read Secrets Permissions
• Fix the user id manually - high enough - look into Keptn/Keptn Container Running With Low UID

Run with all fixes available here

[codecov]

Codecov Report

Merging #700 (cbaa386) into main (d33af19) will increase coverage by 0.04%.
The diff coverage is 90.90%.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #700      +/-   ##
==========================================
+ Coverage   57.33%   57.38%   +0.04%     
==========================================
  Files          88       89       +1     
  Lines        7001     7011      +10     
==========================================
+ Hits         4014     4023       +9     
- Misses       2821     2822       +1     
  Partials      166      166              

Impacted Files	Coverage Δ
...okcontroller/keptnwebhookcertificate_controller.go	52.00% <66.66%> (ø)
operator/controllers/common/providers/common.go	100.00% <100.00%> (ø)
...ontrollers/lifecycle/keptnevaluation/controller.go	81.28% <100.00%> (ø)
...lers/lifecycle/keptnworkloadinstance/controller.go	80.99% <0.00%> (-0.46%)	⬇️
operator/apis/lifecycle/v1alpha2/common/common.go	100.00% <0.00%> (ø)
operator/controllers/common/phasehandler.go	82.08% <0.00%> (+0.83%)	⬆️

Flag	Coverage Δ
component-tests	53.08% <100.00%> (-0.43%)	⬇️
keptn-cert-manager	?
klt-cert-manager	67.50% <66.66%> (?)
scheduler	21.17% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

[sonarcloud]

Kudos, SonarCloud Quality Gate passed!   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
0.0% Duplication