Volumes for plugin template sidecar container

# Summary

Currently, a plugin sidecar container cannot request a volume (they can use volume mount) because we don't provide a way for them to list the volumes they want.

This has pros, e.g. it prevents two plugins for sharing a volume - a security risk. In also prevent volume name conflicts.

We could prevent both of these by validating plugins to ensure any volume mounts are effectively namespaced by:

* Volumes names must be prefixed by the plugin name.
* The container only mounts volumes that are listed in the plugin spec.

# Use Cases

When using a plugin that is based on a library that needs a volume.

---

**Message from the maintainers**:

Love this enhancement proposal? Give it a 👍. We prioritise the proposals with the most 👍.

The issue names no files or tests. Start by tracing the plugin template/spec and sidecar volume-mount validation, then add coverage for plugin-prefixed volume names and rejection of mounts whose volumes are not listed in the plugin spec.

Written by the indexing model from the issue text.