Tasks need hardening

[sudo-bmitch]

Current Behavior

Current tasks allow lots of parameters that could be useful for attackers. E.g. the image being run for these is a parameter in most Task definitions.

Expected Behavior

Tasks and Pipelines should be hardened to run builds securely.

Possible Solution or Alternative

Tasks should have their parameters limited to content that is safe for an untrusted user to provide.

Context

[yfolias]

After reviewing the tasks and the pipelines included in the example section, I concluded that there are two potential solutions, either hardcode part or the entire param values or implement an OPA policy. There is already an ongoing piece of work related to enforcing the use of signed images via an OPA policy, so unless otherwise stated, there is no additional work to be done