NDEV-20544: add remediate policies for RBAC best practices

[Chandan-DK]

Description:

This PR adds remediation policies for the following RBAC best practices policies:

• restrict-automount-sa-token
• restrict-clusterrole-nodesproxy
• restrict-wildcard-resources

In remediate-restrict-clusterrole-nodesproxy policy, we are replacing nodes/proxy with "" instead of removing it. Consider we have a ClusterRole like this where the resources array contains a single element nodes/proxy

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: badcr03
rules:
- apiGroups: [""]
  resources: ["nodes/proxy"]
  verbs: ["get", "watch", "list"]

When we apply the remediate policy on this, it gets mutated to:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: badcr03
rules:
- apiGroups: [""]
  resources: [""]
  verbs: ["get", "watch", "list"]

If we had performed a remove operation on nodes/proxy, then creation of the ClusterRole would have been blocked by Kubernetes with the following error:

The ClusterRole "badcr03" is invalid: rules[0].resources: Required value: resource rules must supply at least one resource

An empty string "" does not match any resources and can be considered a dummy value.

The above approach of replacing instead of removing has been followed in remediate-restrict-wildcard-resources policy too

Related Issues:

Checklist:

• [ ] This PR requires a bump in kyverno-policies chart version .
• [ ] I have created a PR to bump the enterprise-kyverno-operator chart version.