NDEV-18111: add mutate policy for adding-capabilities-strict rule

[suhasgummanirmata]

Description:

Final Changes:

Replace is not supported in kyverno1.10. So, used a combination of remove and add.

Add a rule to restrict-adding-capabilities-other-than-net-bind-service.

The patchesJson6902 method can be useful when a specific mutation is needed which cannot be performed by patchesStrategicMerge. For example, when needing to mutate a specific object within an array, the index can be specified as part of a patchesJson6902 mutation rule.

One distinction between this and other mutation methods is that patchesJson6902 does not support the use of conditional anchors. Use preconditions instead. Also, mutations using patchesJson6902 to Pods directly are not converted to higher-level controllers such as Deployments and StatefulSets through the use of the auto-gen feature. Therefore, when writing such mutation rules for Pods, it may be necessary to create multiple rules to cover all relevant Pod controllers.

Since we cannot use conditional anchors had to use two pre conditions.

• Previously, the existing rule for drop all capabilities was clearing all entries in securityContext. Fixed it

[Chandan-DK]

Please add Chainsaw tests for this. Also, is there a reason why we don't explicitly check for Pods? 🤔 It seems like other remediate policies in the library don't check for Pods either. Otherwise, LGTM!

[Chandan-DK]

@anusha94 - Please approve this PR, we can get it merged and the chainsaw tests will pass