Harden addons & system pods

Our system pods should run using security best practices, both to enhance cluster security and serve as examples of best practices to users. We should audit all our system pod Dockerfiles, and make sure all security features are enabled with custom profiles when possible.

Low hanging fruit:

- Run as non-root (& disallow privilege escalation)
- Run with the default seccomp profile
- ReadOnlyRootFilesystem
- Avoid unnecessary HostPath volumes
- Don't mount service account token (unless required)

More advanced:

- Reduce depednencies in the base image (https://github.com/kubernetes/kubernetes/issues/40248)
- Custom seccomp profile
- Custom AppArmor profile
- Drop unneeded capabilities (e.g. `CAP_NET_RAW`)
- ~~Run with restricted service accounts~~ (done)

/cc @kubernetes/sig-auth @kubernetes/sig-cluster-lifecycle

Start by auditing all system pod Dockerfiles and their corresponding pod configuration against the listed security practices. Check which controls apply to each pod, including non-root execution, seccomp, read-only filesystems, HostPath volumes, service account tokens, capabilities, and security profiles. Done means applicable protections are enabled or an exception is documented for every system pod.

Written by the indexing model from the issue text.