fix: harden operator manager pod with readOnlyRootFilesystem and resource limits

[sampras343]

What

Harden the operator manager deployment (config/manager/manager.yaml):

• Set readOnlyRootFilesystem: true on the manager container
• Set resource requests/limits: CPU 10m/500m, Memory 64Mi/256Mi

Why

The manager container's SecurityContext was missing readOnlyRootFilesystem, which fails restricted Pod Security Standards. A writable rootfs also means a compromised process (e.g., RCE via a dependency vulnerability) could drop binaries or modify DNS config inside the container.

Resource limits were {}. MVO runs a webhook in the admission path of every pod creation. A webhook with no memory limit that leaks under load can OOM-kill other pods on the node via eviction pressure. CPU limits prevent a runaway reconciliation loop from starving the kubelet.

Both are about MVO being trustworthy as a security component.

Summary

• Add readOnlyRootFilesystem: true to the manager container SecurityContext to meet restricted Pod Security Standards and prevent filesystem tampering in a compromised-process scenario
• Set resource requests/limits (CPU 10m/500m, Memory 64Mi/256Mi) to prevent unbounded resource consumption from webhook storms or runaway reconciliation

Closes #182

Release Note

Documentation

[sampras343]

The comment is still preserved to allow users to edit these resource limits based on requirements. But a default is set as a preventive method in case of mem leaks.