Harden bedrock migration Job for Kyverno

[YCShen1010]

What this PR does / why we need it:
Make the bedrock migration Job Kyverno-compliant by adding resource requests/limits, supporting pinned image references, and hardening container/pod security while providing a writable tmp volume.

Which issue(s) this PR fixes:
Fixes # https://github.ibm.com/IBMPrivateCloud/roadmap/issues/68808/#issuecomment-181904012

Changes: :

• Added resources.requests and resources.limits
• Replaced fixed image with templated support for cpfs.utilsImage or tag + optional cpfs.imageDigest.
• Added container securityContext (runAsNonRoot, allowPrivilegeEscalation: false, readOnlyRootFilesystem: true).
• Mounted an emptyDir at tmp
• Added pod volumes so ephemeral writes still work.

[Daniel-Fan]

Hold the PR for now. Will need to discuss with CICD about how image digest is delivered during the build process.

[YCShen1010]

Run:

helm template test . > job.yaml
oc apply -f job.yaml

Local test result:

✗ oc apply -f job.yaml
job.batch/bedrock-migration-job unchanged
serviceaccount/bedrock-migration-job-sa unchanged
role.rbac.authorization.k8s.io/bedrock-migration-job-role-migrationjob unchanged
role.rbac.authorization.k8s.io/bedrock-migration-job-role unchanged
role.rbac.authorization.k8s.io/bedrock-migration-job-role unchanged
rolebinding.rbac.authorization.k8s.io/bedrock-migration-job-rb-migrationjob unchanged
rolebinding.rbac.authorization.k8s.io/bedrock-migration-job-rb unchanged
rolebinding.rbac.authorization.k8s.io/bedrock-migration-job-rb unchanged

pod completed

[Daniel-Fan]

Thank you @YCShen1010
The changes look good to me!