RUN-1121 | feat: run odiglet and data-collection as non-privileged by default

[RonFed]

What this PR does / why we need it:

The odiglet daemonset ran its containers as privileged by default, and there was no explicit flag controlling the data-collection container at all — its privilege level was implied by the collected signals. Running it non-privileged required --set signals="{traces}", which coupled an unrelated setting to a security decision and made logs/metrics collection
impossible without privileged mode.

This PR:

• Runs the odiglet and data-collection containers non-privileged by default, using the capabilities, appArmorProfile and seLinuxOptions already defined per container.
• Replaces odiglet.unPrivileged with per-container odiglet.odiglet.privileged and odiglet.dataCollection.privileged, both defaulting to false. The old key sat at the pod level but only ever controlled the odiglet and init containers, which was misleading.
• Removes the signals-derived privilege decision, so data-collection can run non-privileged with metrics and logs enabled.
• Adds odiglet.dataCollection.seLinuxOptions (default spc_t), the SELinux domain the container already receives when running privileged, so dropping privileged does not change its domain on SELinux-enforcing nodes.
• Adds SYSLOG and SYS_RESOURCE to data-collection when profiling.enabled is true, only when not already present in the user-supplied capabilities list. The eBPF profiler reads /proc/kallsyms addresses (CAP_SYSLOG) and raises RLIMIT_MEMLOCK (CAP_SYS_RESOURCE).
• for OBI NET_ADMIN and NET_RAW are added to the default capability set of the odiglet container - these can be removed if OBI is not used.
• For community go instrumentation we add the KILL capability since the upstream go openteleemtry instrumentation use signal(0) to check for existance of a PID.

Changelog entry: Does this PR introduce a user-facing bug fix, feature, dependency update, or breaking change??

feat: [BREAKING CHANGE] the odiglet and data-collection containers now run as non-privileged by default. To restore the previous behavior set `odiglet.odiglet.privileged=true` and `odiglet.dataCollection.privileged=true`.
feat: [BREAKING CHANGE] `odiglet.unPrivileged` is replaced by the per-container `odiglet.odiglet.privileged` and `odiglet.dataCollection.privileged` flags, to make clear they apply to individual containers in the odiglet daemonset and not to the whole pod.
feat: [BREAKING CHANGE] the `k8s-csi-driver` mount method now requires `odiglet.odiglet.privileged=true`.
feat: data-collection can now run non-privileged with metrics and logs enabled; it is no longer implied by `signals`.

[blumamir]

added few nit comments

[blumamir]

I guess if it's possible then all people would prefer to use it right, but then we should mention when it would not work and under which conditions it needs to be set?

[blumamir]

will it work for oss? should we check and fail the deployment if it's used where not supported?

[blumamir]

When someone will need to use it, how can he know what to write here in order to make it work?
Should we mention when to use it and how?

[blumamir]

we can write this into the template, right? it will be easy to miss. if we choose to keep it, should we also add a comment next to profiling.enabled to make it more discoverable?