[BUG] [Istio-based service mesh add-on] Security recommendations for install-cni container should be addressed or configurable

Microsoft Defender for Cloud flags several security recommendations for the install-cni container:

- Container CPU and memory limits should be enforced
- Immutable (read-only) root filesystem should be enforced for containers
- Kubernetes clusters should disable automounting API credentials
- Least-privileged Linux capabilities should be enforced for containers
- Running containers as the root user should be avoided

Please review whether these recommendations can be implemented by default. If some of them cannot be enabled due to functional requirements, the corresponding settings should be made configurable so that users can apply the required hardening measures themselves.

Environment
- Kubernetes version: 1.36.3
- Istio-based service mesh add-on: asm-1-30