psa: add dynamic psa-level handling

[ibihim]

What

Add the functionality to enforce the strictest of the warn and audit pod security labels, instead of just a fixed level.

Why

On a run against all namespaces, it would try to enforce a restricted level, on namespaces that consciously made the decision to be privileged (or baseline).

[deads2k]

/approve

will leave lgtm with the team.

[s-urbaniak]

/lgtm