ROX-19575: Policies for audit log tampering detection via file activity monitoring

[robbycochran]

Description

Add policies to monitor oauth, kube, and openshift api log directories.

## User-facing documentation

• CHANGELOG.md is updated OR update is not needed
• documentation PR is created and is linked above OR is not needed

Testing and quality

• the change is production ready: the change is GA, or otherwise the functionality is gated by a feature flag
• CI results are inspected

Automated testing

• added unit tests
• added e2e tests
• added regression tests
• added compatibility tests
• modified existing tests

How I validated my change

change me!

[github-actions]

🚀 Build Images Ready

Images are ready for commit 8934542. To use with deploy scripts:

export MAIN_IMAGE_TAG=4.11.x-1028-g893454255c

[openshift-ci]

@robbycochran: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/ocp-4-12-nongroovy-e2e-tests	8934542	link	false	/test ocp-4-12-nongroovy-e2e-tests
ci/prow/ocp-4-12-qa-e2e-tests	8934542	link	false	/test ocp-4-12-qa-e2e-tests
ci/prow/ocp-4-21-nongroovy-e2e-tests	8934542	link	false	/test ocp-4-21-nongroovy-e2e-tests

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.