[Feature request] lockdown the securityContext

[jennerm]

The security context is not configurable and currently only adds extra controls that the pod/container needs, it does not remove any of the controls that are not needed. Presumably the pod does not need them all, so it would be better it the securityContext was explicitly locked down as far as possible for the controls recommended in the PSS restricted profile?

For instance, could it default to this?

spec:
[...]
  securityContext:
    runAsGroup: 65534
    runAsNonRoot: true
    runAsUser: 65534
    seccompProfile:
      type: RuntimeDefault
[...]
  container:
    name: eks-pod-identity-agent
    securityContext:
      allowPrivilegeEscalation: false
      privileged: false
      readOnlyRootFilesystem: true
      capabilities:
        add:
        - CAP_NET_BIND_SERVICE
[...]
  initContainers:
    name: eks-pod-identity-agent-init
    securityContext:
      allowPrivilegeEscalation: false
      privileged: true
      readOnlyRootFilesystem: true
      capabilities:
        drop:
          - ALL