Add local user account creation for host process containers

[dcantah]

This allows a user the ability to pass a Windows group name as the username for the container. What happens in this
case is:

1. Client provides a Windows group name as the username for the container
2. We validate that it's a group, and if so then make a temporary local
   account.
3. Add local account to the group passed in and run the container under the
   account.
4. On container exit delete the account.

This allows a client to setup a group with whatever permissions/restrictions
needed on it and have any host process containers run as a user in the group.
The blocker for not just creating a user itself with the right permissions is
there's no cri field to pass a user password, and passwordless logon seems to be
blocked on Windows by default.

[marosset]

I tried out these changes in a K8s cluster and everything is working as expected.

On one of the Windows nodes I performed the following actions

1. Create a new local group

net localgroup hpc-users /add

1. Create a new share that hpc-users has access to

mkdir c:\hpc-user-share
icacls c:\hpc-user-share /inheritance:r
icacls c:\hpc-user-share /grant:r SYSTEM:(OI)(CI)(F)
icacls c:\hpc-user-share /grant:r BUILTIN\Administrators:(OI)(CI)(F)
icacls c:\hpc-user-share /grant:r hpc-users:(OI)(CI)(F)

icacls c:\hpc-user-share
c:\hpc-user-share 1576k8s00000000\hcp-users:(OI)(CI)(F)
                  BUILTIN\Administrators:(OI)(CI)(F)
                  NT AUTHORITY\SYSTEM:(OI)(CI)(F)

1. Create a share that hpc-users does not have access to

mkdir c:\admin-share
icacls c:\admin-share /inheritance:r
icacls c:\admin-share /grant:r SYSTEM:(OI)(CI)(F)
icacls c:\admin-share /grant:r BUILTIN\Administrators:(OI)(CI)(F)

C:\Users\azureuser>icacls c:\admin-share
c:\admin-share BUILTIN\Administrators:(OI)(CI)(F)
               NT AUTHORITY\SYSTEM:(OI)(CI)(F)

(not a step but here are the ACLs for c:\windows)

icacls c:\windows
c:\windows NT SERVICE\TrustedInstaller:(F)
           NT SERVICE\TrustedInstaller:(CI)(IO)(F)
           NT AUTHORITY\SYSTEM:(M)
           NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F)
           BUILTIN\Administrators:(M)
           BUILTIN\Administrators:(OI)(CI)(IO)(F)
           BUILTIN\Users:(RX)
           BUILTIN\Users:(OI)(CI)(IO)(GR,GE)
           CREATOR OWNER:(OI)(CI)(IO)(F)
           APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX)
           APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE)
           APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(RX)
           APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(OI)(CI)(IO)

I think created a pod with the following deployment file

apiVersion: v1
kind: Pod
metadata:
  name: test-account-test
spec:
  securityContext:
    windowsOptions:
      hostProcess: true
      runAsUserName: hpc-users
  hostNetwork: true
  containers:
  - name: test
    image: mcr.microsoft.com/windows/nanoserver:1809
    command:
      - "ping"
      - "-t"
      - "127.0.0.1"
  nodeSelector:
    "kubernetes.io/os": windows

Exec'ed into it and ran the following actions.
Everything behaved as I would expect

C:\C\dc5fa129a454d485e76f291b905c62ea3b096ef742051cd7dac592dfffb420ed>whoami
1576k8s00000000\dc5fa129a454d485e76f

C:\C\dc5fa129a454d485e76f291b905c62ea3b096ef742051cd7dac592dfffb420ed>cd c:\hpc-user-share

c:\hpc-user-share>echo "" > temp

c:\hpc-user-share>cd c:\admin-share
Access is denied.

c:\hpc-user-share>cd c:\Windows

c:\Windows>echo "" > temp
Access is denied.

[dcantah]

@ambarve @helsaawy This should be ready for review. Edit: Spoke too soon 🤣

Edit 2: Needed a rebase :)

[dcantah]

@ambarve ptal when you get a chance

[dcantah]

Actually this needs a quick rebase

[katiewasnothere]

lgtm