feat: Add opt-in option for zarf init

[yuvalsimon]

Description

This PR adds flags --agent-namespaces-mode=[active|passive] and --agent-objects-mode=[active|passive] to zarf init command. By default, both are set to active. When using either of them to passive, MutatingWebhookConfiguration will be deployed with rules that enforce namespaces/objects to be labeled with zarf.dev/agent: mutate, or else the images won't be mutated. An exception that was added is zarf namespace, there effectively modes are always active (which enables us deploy there Gitea for instance)

examples:

• agent-namespaces-mode=active; agent-objects-mode=active: Current zarf behaviour
• agent-namespaces-mode=passive; agent-objects-mode=active: If namespace is labeled with zarf.dev/agent: mutate then like current zarf behaviour on this whole namespace. Otherwise no images are mutated at all. If the pod is labeled with zarf.dev/agent: ignore, then it won't be mutated neither.
• agent-namespaces-mode=active; agent-objects-mode=passive: If a pod is labeled with zarf.dev/agent: mutate then image is mutated pod. Otherwise no mutation is applied.
• agent-namespaces-mode=passive; agent-objects-mode=passive: Only if both namespace and pod in the namespace are labeled zarf.dev/agent: mutate then image mutation occurs.

Related Issue

Relates to #4419

Checklist before merging

• Test, docs, adr added or updated as needed
• Contributor Guide Steps followed

[netlify]

✅ Deploy Preview for zarf-docs canceled.

Name	Link
🔨 Latest commit	979296e
🔍 Latest deploy log	https://app.netlify.com/projects/zarf-docs/deploys/693a75de440f8e00088ff7df

[AustinAbro321]

Hello @yuvalsimon, really appreciate you making this PR. This is definitely a workflow that I feel Zarf should support. I am curious about your use cases. Could you tell me situations where you tend to use agent-objects-mode=active. Do you tend to only want mutations on certain kinds of resources, for instance, you want to mutate pods, but not Flux Git Repositories? Or is it the case where you want one package mutated in a namespace, but not the other?

From the issue I see that you have kyverno adding this label. I think for the best user experience, we would want these labels to be automatically added to namespaces Helm post-renderer in AdoptZarfManagedLabels. This way any Zarf deployments automatically opt into mutation. Something similar could be done for pods and argo / flux resources. Do you have use cases, where you would not want this behavior?