Support for "restricted" pod security policy

## Describe the feature

With Kubernetes 1.25 [Pod Security Admission](https://kubernetes.io/docs/concepts/security/pod-security-admission/) becomes a standard to enforce a particular [Pod Security Standard](https://kubernetes.io/docs/concepts/security/pod-security-standards/). For supporting the policy `restricted`, specific fields need to be provided in a Pod `.spec` (like dropping capabilities). Knative needs to adapt these fields in:

* The Knative control- and data-plane
* User deployed workloads like pods created on behalf of KServices or Eventing sources (like the apiserversource deployment).

When warnings are switched on, we see currently the following 16 violations:

Admission violations

```
* would violate PodSecurity "restricted:latest": allowPrivilegeEscalation != false (containers "gather", "copy" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (containers "gather", "copy" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or containers "gather", "copy" must set securityContext.runAsNonRoot=true), seccompProfile (pod or containers "gather", "copy" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")
* would violate PodSecurity "restricted:v1.24": allowPrivilegeEscalation != false (container "kube-rbac-proxy" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (containers "activator", "kube-rbac-proxy" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "kube-rbac-proxy" must set securityContext.runAsNonRoot=true), seccompProfile (pod or containers "activator", "kube-rbac-proxy" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")
* would violate PodSecurity "restricted:v1.24": allowPrivilegeEscalation != false (container "kube-rbac-proxy" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (containers "autoscaler", "kube-rbac-proxy" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "kube-rbac-proxy" must set securityContext.runAsNonRoot=true), seccompProfile (pod or containers "autoscaler", "kube-rbac-proxy" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")
* would violate PodSecurity "restricted:v1.24": allowPrivilegeEscalation != false (container "kube-rbac-proxy" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (containers "autoscaler-hpa", "kube-rbac-proxy" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "kube-rbac-proxy" must set securityContext.runAsNonRoot=true), seccompProfile (pod or containers "autoscaler-hpa", "kube-rbac-proxy" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")
* would violate PodSecurity "restricted:v1.24": allowPrivilegeEscalation != false (container "kube-rbac-proxy" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (containers "controller", "kube-rbac-proxy" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "kube-rbac-proxy" must set securityContext.runAsNonRoot=true), seccompProfile (pod or containers "controller", "kube-rbac-proxy" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")
* would violate PodSecurity "restricted:v1.24": allowPrivilegeEscalation != false (container "kube-rbac-proxy" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (containers "dispatcher", "kube-rbac-proxy" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "kube-rbac-proxy" must set securityContext.runAsNonRoot=true), seccompProfile (pod or containers "dispatcher", "kube-rbac-proxy" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")
* would violate PodSecurity "restricted:v1.24": allowPrivilegeEscalation != false (container "kube-rbac-proxy" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (containers "domain-mapping", "kube-rbac-proxy" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "kube-rbac-proxy" must set securityContext.runAsNonRoot=true), seccompProfile (pod or containers "domain-mapping", "kube-rbac-proxy" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")
* would violate PodSecurity "restricted:v1.24": allowPrivilegeEscalation != false (container "kube-rbac-proxy" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (containers "domainmapping-webhook", "kube-rbac-proxy" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "kube-rbac-proxy" must set securityContext.runAsNonRoot=true), seccompProfile (pod or containers "domainmapping-webhook", "kube-rbac-proxy" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")
* would violate PodSecurity "restricted:v1.24": allowPrivilegeEscalation != false (container "kube-rbac-proxy" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (containers "eventing-controller", "kube-rbac-proxy" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "kube-rbac-proxy" must set securityContext.runAsNonRoot=true), seccompProfile (pod or containers "eventing-controller", "kube-rbac-proxy" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")
* would violate PodSecurity "restricted:v1.24": allowPrivilegeEscalation != false (container "kube-rbac-proxy" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (containers "eventing-webhook", "kube-rbac-proxy" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "kube-rbac-proxy" must set securityContext.runAsNonRoot=true), seccompProfile (pod or containers "eventing-webhook", "kube-rbac-proxy" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")
* would violate PodSecurity "restricted:v1.24": allowPrivilegeEscalation != false (container "kube-rbac-proxy" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (containers "filter", "kube-rbac-proxy" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "kube-rbac-proxy" must set securityContext.runAsNonRoot=true), seccompProfile (pod or containers "filter", "kube-rbac-proxy" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")
* would violate PodSecurity "restricted:v1.24": allowPrivilegeEscalation != false (container "kube-rbac-proxy" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (containers "ingress", "kube-rbac-proxy" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "kube-rbac-proxy" must set securityContext.runAsNonRoot=true), seccompProfile (pod or containers "ingress", "kube-rbac-proxy" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")
* would violate PodSecurity "restricted:v1.24": allowPrivilegeEscalation != false (container "kube-rbac-proxy" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (containers "mt-broker-controller", "kube-rbac-proxy" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "kube-rbac-proxy" must set securityContext.runAsNonRoot=true), seccompProfile (pod or containers "mt-broker-controller", "kube-rbac-proxy" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")
* would violate PodSecurity "restricted:v1.24": allowPrivilegeEscalation != false (container "kube-rbac-proxy" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (containers "webhook", "kube-rbac-proxy" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "kube-rbac-proxy" must set securityContext.runAsNonRoot=true), seccompProfile (pod or containers "webhook", "kube-rbac-proxy" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")
* would violate PodSecurity "restricted:v1.24": unrestricted capabilities (container "dispatcher" must set securityContext.capabilities.drop=["ALL"]), seccompProfile (pod or container "dispatcher" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")
* would violate PodSecurity "restricted:v1.24": unrestricted capabilities (container "migrate" must set securityContext.capabilities.drop=["ALL"]), seccompProfile (pod or container "migrate" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")
```

This issue is not specific to serving (it also applies to eventing), but starting a tracking umbrella issue here nevertheless.

No files or tests are named. Start by inventorying the control-plane, data-plane, and user-workload pod definitions, then compare the listed violations with Kubernetes' restricted policy requirements. Done means the affected workloads satisfy the required securityContext and seccomp settings without the reported admission warnings.

Written by the indexing model from the issue text.