feat(checks): Deprecate remaining PSP checks

[simar7]

Close: aquasecurity/trivy#5541

[simar7]

@nikpivkin since you recently checked the CIS benchmarks, should they be updated as well as some of them check for this check as can be seen here:

trivy-checks/pkg/specs/compliance/k8s-cis-1.23.yaml

Lines 285 to 293 in 6f4dbd8

	- id: 1.2.13
	name: Ensure that the admission control plugin SecurityContextDeny is set if
	PodSecurityPolicy is not used
	description: The SecurityContextDeny admission controller can be used to deny
	pods which make use of some SecurityContext fields which could allow for
	privilege escalation in the cluster. This should be used where
	PodSecurityPolicy is not in place within the cluster
	checks:
	- id: AVD-KCV-0013

[nikpivkin]

@simar7 You mean update the k8s checks to align with the benchmarks?

[simar7]

@simar7 You mean update the k8s checks to align with the benchmarks?

I think we will need to keep that check as we only target 1.23 which still has it. Unless we update to target a newer version of k8s. For now we can just add a deprecation message to inform the users about it. I've updated the PR accordingly.

[nikpivkin]

@simar7 In such a situation, we specify a frameworks field for cloud checks that lists the benchmarks. If the user passes a compliance flag with one of the benchmarks when scanning, only then this check is applied. An example of a check that will not be loaded by default when scanning: https://github.com/aquasecurity/trivy-checks/blob/main/checks/cloud/aws/cloudwatch/require_cloudtrail_change_alarm.rego#L19-L23. I think we can do something like this here. Wdyt?

[simar7]

@simar7 In such a situation, we specify a frameworks field for cloud checks that lists the benchmarks. If the user passes a compliance flag with one of the benchmarks when scanning, only then this check is applied. An example of a check that will not be loaded by default when scanning: https://github.com/aquasecurity/trivy-checks/blob/main/checks/cloud/aws/cloudwatch/require_cloudtrail_change_alarm.rego#L19-L23. I think we can do something like this here. Wdyt?

Good point, updated.