score/security: added optional, splitted probes as future replacemnt …

[markuslackner]

…for security context probe

Fixes #325

RELNOTE: container-security-context now deprecated and added optional probes container-security-context-user-group-id, container-security-context-privileged and container-security-context-readonlyrootfilesystem as replacement

[markuslackner]

@zegl Can you take a look?

Some remarks:

• the user/group id probe and the privileged probe need an existing security context. if its missing two almost identical errors will be generated.
• I duplicated most of the tests and activated the appropriate optional probe. It should be quite easy to delete the original securitycontext probe in a future release
• I updated the documentation and added a new doc file for security context. Is this ok and is the content understandable?

[zegl]

Thanks for working on this! The changes looks good to me, but I'd like it to make the communication about this (future) breakage a bit clearer.

[zegl]

I'd like to commit to the following timeline, and think that it would be a good idea to mention it in this document.

• v1.10: Introduce the three new checks.
• v1.11: Make container-security-context optional, and make the three new checks run by default.
• v1.12: Remove container-security-context.

Since this is going to be a breaking change, I'd like to be as clear as possible with what's going to happen, so that users get a chance to prepare.

[markuslackner]

I have updated the document

[zegl]

Looks good to me! Thanks a lot for your contribution.

bors merge

[bors]

Build succeeded:

• ci/circleci: test