Alway require override privilege for syncing arbitrary revisions per default

[schraax]

Summary

in #22858, a toggle was introduced to require override privilege when syncing to revisions other than the revision defined in the Application object. In order to not break existing workflow, the toggle was introduced as disabled.
As of now, the toggle is planned to be released with v3.2.

This issue should remind us to set
'application.sync.requireOverridePrivilegeForRevisionSync: "true"' as default, this is planned for v3.4

Motivation

The toggle is needed to preserve RBAC compliance, but was introduced in disabled state to not break installations.
It should be set as default, once people have been getting used to it.

Proposal

Change code to assume "rtue as default, if setting is missing
change helm chart to include this setting.

[Aamir017]

Hey @agaudreault 👋

It seems like a good time to start making requireOverridePrivilegeForRevisionSync default to true.

• This preserves RBAC compliance by default without relying on users to opt-in.
• Existing workflows won’t break anymore since users have had time to adjust since v3.2.
• Helm charts should also include this setting by default to keep everything consistent.

This change would make revision sync security safer out of the box while keeping the upgrade path smooth.

[github-actions]

This issue has been marked as stale because it has had no activity for 90 days. Please comment if this is still relevant.