config: add restricted PSS contexts for suggestions

[danish9039]

What this PR does / why we need it:

This PR makes the built-in Katib suggestion deployments compatible with Kubernetes restricted Pod Security Standards by using existing runtime.suggestions[*].securityContext support in the install configs.

It also enables init.controller.injectSecurityContext so Katib metrics collector init containers get restricted-compatible security contexts. No API/schema fields or Trial template mutation are added.

OpenShift install note: katib-openshift keeps the restricted fields but omits a fixed runAsUser so OpenShift SCC UID allocation can choose the namespace-assigned UID.

Validation:

• KUBEBUILDER_ASSETS="$(/home/danish/go/bin/setup-envtest use 1.34.0 -p path)" go test -count=1 ./pkg/util/v1beta1/katibconfig ./pkg/controller.v1beta1/suggestion/composer
• kustomize build for all six install overlays plus katib-with-kubeflow
• git diff --check

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Related to kubeflow/community-distribution#3487

Checklist:

• Docs included if any changes are user facing

[github-actions]

🎉 Welcome to the Kubeflow Katib repo! 🎉

Thanks for opening your first PR! We're excited to have you onboard 🚀

Next steps:

• Our team will review your PR soon! cc @kubeflow/wg-automl-leads
• Check out the Contributing Guide and the Kubeflow Contributor Guide
• Join the Kubeflow Slack channels: https://www.kubeflow.org/docs/about/community/#kubeflow-slack-channels
• Join the AutoML & Training WG meetings: https://bit.ly/2PWVCkV

Feel free to ask questions in the comments. Thanks again for contributing! 🙏

[google-oss-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign johnugeorge for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coveralls]

Coverage is 9.93% — danish9039:pr3487/katib-restricted-pss into kubeflow:master. No base build found for kubeflow:master.