feat: introduce Pepr common policies

[jeff-mccoy]

Description

Introduce Pepr Validations to replace Kyverno.

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Other (security config, docs update, etc)

Checklist before merging

• Test, docs, adr added or updated as needed
• Contributor Guide Steps(https://github.com/defenseunicorns/uds-template-capability/blob/main/CONTRIBUTING.md#submitting-a-pull-request) followed

[mjnagel]

I think there's definitely more to review here on the actual policy contents but wanted to comment here with an overarching issue on policies not being enforced.

I crafted malicious pods + services that should have been blocked by every single policy. What I found was that only the final policy for pods in networking (hostport) actually blocked the pod. The same was true for service, only the final policy for service in networking (nodeport) blocked the service. It appears as if only the final approve/deny for the pod actually affects the admission. Other policies that the pod violates showed as logs in pepr, but the pod/svc were still admitted. I did some testing to confirm and reordering policies in networking.ts changes what is actually enforced (always the last policy). I also modified the index.ts to change the import order and confirmed that the order of the imports has an effect on what is enforced.

TLDR: Last policy, in the last import in index.ts is the only one that gets properly enforced.

[mjnagel]

Number of nits and a few logic issues. Went through each policy individually to validate they worked as expected.

[mjnagel]

Overall LGTM, love the tests. Few small comments with suggestions for your review.

[mjnagel]