Harden OpenShift manual-install SCC troubleshooting guidance

Summary

The OpenShift manual-install documentation recommends granting the privileged SCC to the default ServiceAccount in openshift-gitops-operator when the operator image fails the non-root policy.

Rationale

Granting privileged to default makes it available to every workload that uses that ServiceAccount in the namespace. The guidance should not broaden SCC permissions for unrelated workloads.

Affected area

• argocd-operator/docs/install/openshift.md
• The runAsUser breaks non-root policy troubleshooting note in the manual-install section.

Required changes

Replace the default ServiceAccount workaround with guidance that uses a dedicated ServiceAccount for the affected deployment. Identify or recommend the least-privileged SCC that resolves the image policy error. State how to bind that SCC only to the dedicated ServiceAccount.

Acceptance criteria

• The documentation does not instruct users to grant privileged SCC to default.
• The affected operator deployment uses a dedicated ServiceAccount when an SCC exception is required.
• The documentation recommends the least-privileged suitable SCC before privileged.
• The guidance explains the scope of the SCC binding.

Backlinks

• PR: https://github.com/redhat-developer/gitops-operator/pull/1294
• Review comment: https://github.com/redhat-developer/gitops-operator/pull/1294#discussion_r4016160278
• Requested by: @olivergondza