fix(checks): respect PodSecurityContext for containers

[nikpivkin]

Fixes: aquasecurity/trivy#8210

SecurityContext may inherit some fields from PodSecurityContext. See https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#securitycontext-v1-core

Before:

❯ trivy conf test.yaml
2025-01-14T16:15:39+06:00       INFO    [misconfig] Misconfiguration scanning is enabled
2025-01-14T16:15:43+06:00       INFO    Detected config files   num=1

test.yaml (kubernetes)

Tests: 93 (SUCCESSES: 91, FAILURES: 2)
Failures: 2 (UNKNOWN: 0, LOW: 2, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

AVD-KSV-0020 (LOW): Container 'sec-ctx-demo' of Pod 'security-context-demo' should set 'securityContext.runAsUser' > 10000
═════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════
Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

See https://avd.aquasec.com/misconfig/ksv020
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
 test.yaml:15-35
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
  15 ┌   - name: sec-ctx-demo
  16 │     image: busybox:42
  17 │     command: [ "sh", "-c", "sleep 1h" ]
  18 │     volumeMounts:
  19 │     - name: sec-ctx-vol
  20 │       mountPath: /data/demo
  21 │     resources:
  22 │       requests:
  23 └         cpu: 100m
  ..   
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────


AVD-KSV-0021 (LOW): Container 'sec-ctx-demo' of Pod 'security-context-demo' should set 'securityContext.runAsGroup' > 10000
═════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════
Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

See https://avd.aquasec.com/misconfig/ksv021
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
 test.yaml:15-35
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
  15 ┌   - name: sec-ctx-demo
  16 │     image: busybox:42
  17 │     command: [ "sh", "-c", "sleep 1h" ]
  18 │     volumeMounts:
  19 │     - name: sec-ctx-vol
  20 │       mountPath: /data/demo
  21 │     resources:
  22 │       requests:
  23 └         cpu: 100m
  ..   
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

After:

❯ trivy conf --cache-dir cache --checks-bundle-repository localhost:5111/trivy-checks:latest test.yaml
2025-01-14T16:15:55+06:00       INFO    [misconfig] Misconfiguration scanning is enabled
2025-01-14T16:15:55+06:00       INFO    [misconfig] Need to update the built-in checks
2025-01-14T16:15:55+06:00       INFO    [misconfig] Downloading the built-in checks...
163.59 KiB / 163.59 KiB [---------------------------------------------------------------------------------------------------] 100.00% ? p/s 100ms
2025-01-14T16:15:57+06:00       INFO    Detected config files   num=1

[nikpivkin]

I had to create a separate package for some functions, because the kubernetes package defines an object rule that overrides OPA functions with namespace object. I did not change the name of the rule as it is library and used in checks.

[nikpivkin]

Now securityContext inherits podSecurityContext, so both the rules for the pod and the container are triggered here. We can improve this rule in a separate PR for result deduplication.

[nikpivkin]

I've opened the PR