Document expected failures for file permission issues on RKE and RKE2 Clusters when running CIS Scan

[Priyashetty17]

Issue Description:
Currently, there are CIS checks related to file permissions that are failing on RKE and RKE2 clusters with CIS v1.7 profiles. These failures are expected as of now but will need to be addressed in Q4 release with GH-42012 for RKE and rancher/rke2#4473 for RKE2. However, if these are not addressed in RKE and RKE2, it is important to document these expected failures in the hardening guides for Q4 release.

With CIS v1.7 profile (K8s v1.27.5):

• Here are the CIS checks related to file permissions that are failing on RKE hardened cluster:

State	Number	Description
Fail	4.1.7	Ensure that the certificate authorities file permissions are set to 600 or more restrictive (Automated)

ubuntu@ip-1xx-xx:~$ sudo stat -c permissions=%a /etc/kubernetes/ssl/kube-ca.pem
permissions=644

• Here are the CIS checks related to file permissions that are failing on both RKE2 permissive and hardened clusters:

State	Number	Description
Fail	1.1.1	Ensure that the API server pod specification file permissions are set to 600 or more restrictive (Automated)
Fail	1.1.3	Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated)
Fail	1.1.5	Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive (Automated)
Fail	1.1.7	Ensure that the etcd pod specification file permissions are set to 600 or more restrictive (Automated)

1.1.1:
ubuntu@ip-1xx-xx:~$ sudo stat -c permissions=%a /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml
permissions=644


1.1.3:
ubuntu@ip-1xx-xx:~$ sudo /bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml; then stat -c permissions=%a /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml; fi'
permissions=644

1.1.5:
ubuntu@ip-1xx-xx:~$ sudo /bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml; then stat -c permissions=%a /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml; fi'
permissions=644

1.1.7:
ubuntu@ip-1xx-xx:~$ sudo /bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml; then find /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml -name '*etcd*' | xargs stat -c permissions=%a; fi'
permissions=644

CC @andypitcher @JonCrowther @macedogm @rayandas

[samjustus]

#42012

[vivek-shilimkar]

The same failures are observed on CIS Profile 1.8 and should be documented as well.