Configure pubsubplus container securityContext & Fix checkov CKV_K8S_38 against Pod automountServiceAccountToken should be set to false unless necessary.

[sebay]

Security scans improvement:

1. Gatekeeper
   On top of pod securityContext, container securityContext can also be configured. It will be set on pubsubplus container.
   This is notably useful in constraint environment where gatekeeper policies expect certain securityContext on both pod and container.

spec:
  container:
    securityContext:
      runAsNonRoot: true
      runAsGroup: 1000001
      runAsUser: 1000001
      allowPrivilegeEscalation: false
      privileged: false
      capabilities:
        drop:
          - ALL
      seLinuxOptions:
        level: s0:c123,c456
        role: object_r
        type: svirt_sandbox_file_t
        user: system_u
      seccompProfile:
        type: RuntimeDefault

2. Checkov CKV_K8S_38.
   Set automountServiceAccountToken=false. Mount token with projected volumes. Note the option is not optional as given both operator and created pubsubresource require token, projected volume is always mounted.