Update default for vap generation

[ritazh]

TODO(ritazh): default for now until the feature is safe to fail close
TODO(ritazh): default for now until we can safely expose these to users

[ritazh]

fail closed is blocked by kubernetes/kubernetes#124237

[ritazh]

Notes from today's community call:

• pre-req: need to ensure all resource generation happens in a singleton controller (due to clock skew); add a new operation to ensure only a singleton controller runs for resource generation
• add a delay (user configurable), default is tbd. maximum is 30 secs. Note: delay is only needed for the first VAPB
• deployment strategy for this singleton controller might impact the delay calculation to generate the VAPB resource
• singleton should add timestamp for “createAfter” OR a simple flag to allow creation of VAPB on the CT status; then reschedule the reconcile for the VAPB generation

[JaydipGabani]

TODO:

• Match default failure policy on CEL engine and VAP to fail once - feat: add generate operation and wait for VAPB generation #3573 is merged. Currently By default VAP fails open and CEL fails close.
• Expose operations in VAP - https://github.com/open-policy-agent/gatekeeper/blob/master/pkg/drivers/k8scel/transform/make_vap_objects.go#L62

[JaydipGabani]

This is the existing behavior where CEL fails -

enforcement point	FailurePolicy	EnforcementAction	result
CEL	Fail	deny	Violation
VAP	Fail	deny	Violation
CEL	Fail	warn	Warning
VAP	Fail	warn	Warning
CEL	Ignore	deny	Admission without violation/warning
VAP	Ignore	deny	Admission without violation/warning
CEL	Ignore	warn	Admission without violation/warning
VAP	Ignore	warn	Admission without violation/warning