feat: add policy exemptions

[TristanHoladay]

Description

This PR adds a way for users to register policy exemptions at runtime using the uds-core operator.

Related Issue

Relates to #130

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Other (security config, docs update, etc)

Checklist before merging

• Test, docs, adr added or updated as needed
• Contributor Guide Steps(https://github.com/defenseunicorns/uds-template-capability/blob/main/CONTRIBUTING.md#submitting-a-pull-request) followed

[TristanHoladay]

Ran several options with setting exemptions in the store.

1. synchronously only using setItem() -- not too surprisingly doesn't work when writing to the same policy key multiple times (neuvector for example does this). Because of how the store works, if not given enough time only the last write makes it to the store and then most pods needing exemptions for that policy are denied.

2. asynchronously with setItemAndWait() -- solves the concurrent write problem but is slow and exacerbates the issue of pods starting up before exemptions have made it into the store. In neuvector's case, this means the enforcer pod tries to run and is denied one or more times before successfully deploying.

• trial 1: "msg":"Time to complete exemption write: 118758.07304999232"
• trial 2: "msg":"Time to complete exemption write: 118881.12059801817"}

3. synchronously with local aggregation first -- solves the concurrent write issue by first creating a local map and aggregating all matchers from the Exemption into lists attached to their relevant policy. Then a single write is made for each policy to the store without any waiting for the previous call to finish. This drastically reduces the time for the exemptions to show up in the store. There still seems to be cases of pods getting denied while waiting. However I noticed that they seemed to take less attempts and the neuvector deployment finished faster in this case.

• trial 1: "msg":"Time to complete exemption write: 2.490468978881836"}
• trial 2: "msg":"Time to complete exemption write: 0.44616997241973877"}
• trial 3: "msg":"Time to complete exemption write: 0.9177009463310242"}
• trial 4: "msg":"Time to complete exemption write: 0.4052410125732422"}

Note: these write times are not truly accurate for how long it took for the store to be updated with all exemptions. These numbers reflect how long it took to create the local map and then send each update to the store.

[jeff-mccoy]

Won't be able to review for a couple days due to in-person things, but wanted to flag to make sure I review this one as it's going to touch some of the same areas as the identity work.

[mjnagel]

Think this is in a great spot overall - couple small comments here.

[mjnagel]

One other spot to add explicit {} back - https://github.com/defenseunicorns/uds-core/blob/feat-exemptions/src/pepr/policies/security.ts#L309-L310

[mjnagel]

99% there, couple small things and then this should be g2g

Updates made based on requested changes.