gcp_k8s_rules: require k8s-specific resource type

[skottler]

Background

The GCP audit log contains entries for Bigquery (and likely other services) which have protoPayload fields. This makes the check run against events which aren't relevant. Here is one such event:

...
  "protoPayload": {
	"at_sign_type": "type.googleapis.com/google.cloud.audit.AuditLog",
	"authenticationInfo": {
		"principalEmail": "[redacted]@[redacted].iam.gserviceaccount.com",
		"serviceAccountKeyName": "//iam.googleapis.com/projects/[redacted]/serviceAccounts/[redacted]/keys/[redacted]"
	},
	"authorizationInfo": [
		{
			"granted": true,
			"permission": "bigquery.jobs.create",
			"resource": "projects/[redacted]",
			"resourceAttributes": {}
		}
	],
	"methodName": "tabledataservice.list",
	"requestMetadata": {
		"callerIP": "[redacted]",
		"callerSuppliedUserAgent": "[redacted]"
		"destinationAttributes": {},
		"requestAttributes": {}
	},
	"resourceName": "projects/[redacted]/datasets/[redacted]/tables/[redacted]/data",
	"serviceData": {
		"@type": "type.googleapis.com/google.cloud.bigquery.logging.v1.AuditData",
		"tableDataListRequest": {
			"maxResults": 100
		}
	},
	"serviceName": "bigquery.googleapis.com",
	"status": {}
  }
...

Changes

Bypass check logic (always return false) when the resource type in the audit log is not k8s_cluster. This ensures the check behaves as expected and only picks up events related to Kubernetes.

[CLAassistant]

All committers have signed the CLA.