NVSHAS-7518 auto rotate internal certs

[holyspectral]

This PR is to support 5.4's internal certificate rotation.

1. Update helm charts to support auto internal cert rotation.
2. Via unit-test, make sure that when the feature is off, resources created is the same as before.

Note that this feature will only be enabled on workloads when .Values.image.tag > 5.3.10-0.

[andsont]

3. add neuvector-binding-job-creation and neuvector-binding-cert-upgrader roles in the role.yaml
4. rollback the role-least.yaml
5. rolebinding.yaml
   5-1. add neuvector-binding-job-creation and neuvector-binding-cert-upgrader rolebindings
   5.2. add the followings for neuvector-binding-lease rolebinding

{{- if $oc3 }}
userNames:
- system:serviceaccount:{{ .Release.Namespace }}:{{ .Values.serviceAccount }}
{{- end }}

6. use one condition of {{- if .Values.internal.autoGenerateCert }} for all required rolebindings in the rolebinding-least.yaml
7. change -role- role to -binding- role for all yaml files. make a consistent naming convention
8. the followings are missing in the .controller.certupgrader of the values.yaml

priorityClassName:
podLabels: {}
podAnnotations: {}
nodeSelector:
  {}
  # key1: value1
  # key2: value2
runAsUser: # MUST be set for Rancher hardened cluster
9. the namespace and labels are missing in the controller-secret.yaml, controller-lease.yaml and upgrader-lease.yaml

10. suggest to remove the following in values.yaml

  certupgrader:
    imagePullPolicy: IfNotPresent

hence, remove the following in controller-deployment.yaml

      initContainers:
        - name: init
          imagePullPolicy: {{ .Values.controller.certupgrader.imagePullPolicy }}
      containers:
        - name: neuvector-controller-pod
          imagePullPolicy: Always

11. always enable list,watch verbs in role and enable enforcer,scanner and registry-adapter service accounts in rolebinding. remove the if condition.

{{- if .Values.internal.autoGenerateCert }}
  - list
  - watch
{{- end }}

{{- if .Values.internal.autoGenerateCert }}
- kind: ServiceAccount
  name: enforcer
  namespace: {{ .Release.Namespace }}
- kind: ServiceAccount
  name: scanner
  namespace: {{ .Release.Namespace }}
- kind: ServiceAccount
  name: registry-adapter
  namespace: {{ .Release.Namespace }}
{{- end }}

[williamlin-suse]

upgrader-related rbac checking is missing in controller.
See VerifyNvK8sRBAC() in controller\resource\kubernetes_rbac.go (or search "neuvector-updater-pod" for reference)
(if it's enabled)