harden secrets permissions [BTPCOREAPIGW-3770]

[fizzious1]

This change is aimed at adding an extra layer of protection for secrets in Kubernetes pods.
Currently, the Secrets permissions is set to 420 (decimal) => 644 (octal) => rwx -r- ----, which is considered over-permissive.
The goal is to set the permissions to 256 (decimal) => 400 (octal) => r-- --- ---.

The Secret's permissions we wish to change:

sap-btp-service-operator/sapbtp-operator-charts/templates/deployment.yml

Lines 134 to 137 in 1c3ea5a

	- name: cert
	secret:
	defaultMode: 420
	secretName: webhook-server-cert

[I065450]

Hi @fizzious1

I have tried to change permission to 400 and the operator fail to start.
Regards,
Naama

│ manager 2025-01-30T12:29:03Z ERROR setup problem running manager {"error": "open /tmp/k8s-webhook-server/serving-certs/tls.crt: permission denied"} │
│ manager main.main │
│ manager /workspace/main.go:210 │
│ manager runtime.main │
│ manager /usr/local/go/src/runtime/proc.go:271