sample-apps: handle restricted podsecurityadmission default in 4-dev-preview/4.19

[kaovilai]

Is your feature request related to a problem? Please describe.

PodSecurityAdmission feature gate is enabled [in 4.18] (preview only, slated to be disabled by GA)(https://github.com/openshift/api/blob/a1523024209f3122be9e9d53515da470c6a2458b/features/features.go#L67-L72) (disabled in 4.17), will enforce restricted PodSecurityAdmission by default

which will cause errors like

deployment not available with condition: pods "mongo-5f78d6fd49-74k4r" is forbidden: violates PodSecurity "restricted:latest": privileged (container "mongo" must not set securityContext.privileged=true), allowPrivilegeEscalation != false (containers "mongo", "curl-tool" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (containers "mongo", "curl-tool" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or containers "mongo", "curl-tool" must set securityContext.runAsNonRoot=true), seccompProfile (pod or containers "mongo", "curl-tool" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")

as seen in our 4.18 dev-preview test and found to be possibly targeted for 4.19 release

This feature gate were documented as early as 4.12 it seems, but never enabled by default.

slack

https://issues.redhat.com/browse/OCPSTRAT-487
https://issues.redhat.com/browse/AUTH-262
https://issues.redhat.com/browse/OSDOCS-5004

Part of OADP epic https://issues.redhat.com/browse/OADP-5031
Describe the solution you'd like

Describe alternatives you've considered

Additional context

[openshift-bot]

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale