helm chart security fixes for Oasis LMF

[michael-fehlmann]

Issue Description

In order to fix security issues recognised by our scanning system we would like to request the following changes in Oasis helm charts:

• Immutable (read-only) root filesystem should be enforced for all containers (each container should have readOnlyRootFilesystem : true and mount volumes if necessary)
• Disable automounting API credentials (service account or pod level, automountServiceAccountToken: false). If Kubernetes API is needed than it should be explicitly mounted.

Version / Environment information

• OS / platform / environment used: Kubernetes 1.25+
• affected Oasis versions: All

[sambles]

To do - Kubernetes API

• Apply explicitly mounted Kubernetes API to templates/oasis_worker_controller.yaml)
• Apply Disable automounting API credentials in all other containers / pods

To do - Immutable root filesystem

Apply Read only (all of filesystem) to

• oasis-task-controller
• oasis-server
• oasis-websocket
• oasis-worker-controller
• keycloak
• flower
• celery-beat