fix(manager): support Restricted Pod Security without host CA mounts

[HaoyL666]

Summary

Fixes OKE-44459 by making OSOK
manager deployments compatible with Kubernetes Restricted Pod Security.

The controller now uses the CA trust bundle included in the Oracle Linux 9 image instead
of mounting the worker node's /etc/pki directory.

Changes

• Remove the /etc/pki hostPath volume and mount from all manager deployments.
• Apply Restricted Pod Security settings:
  • runAsNonRoot: true
  • runAsUser: 65532
  • seccompProfile.type: RuntimeDefault
  • allowPrivilegeEscalation: false
  • Drop all Linux capabilities
• Update the generator template and all 146 checked-in manager manifests.
• Add generator tests that validate the security settings and reject hostPath volumes
  or /etc/pki mounts.
• Make local E2E fail if a generated deployment unexpectedly contains the old PKI mount.
• Document custom CA configuration using a ConfigMap or Secret with
  OCI_DEFAULT_CERTS_PATH.

CA behavior

The default Oracle Linux 9 controller image includes the public CA trust bundle needed
for OCI endpoints.

Environments using private or corporate CAs can mount a complete PEM bundle from a
ConfigMap or Secret and configure OCI_DEFAULT_CERTS_PATH.

Validation

• make test passed
  • Manifest and deepcopy generation
  • Formatting
  • go vet ./...
  • Full go test ./...
• Verified no generated-file drift after testing.
• Built and deployed the updated PSQL controller image to OKE.
• Verified the controller starts under Restricted Pod Security without an /etc/pki host
  mount.
• Verified PSQL create, read, update, and delete operations.
• Verified OCI TLS connectivity using the CA bundle included in the image.
• Verified Object Storage connectivity as an additional TLS sanity check.