Pin cri-o and redhat-actions/push-to-registry

[pjbgf]

What type of PR is this?

/kind cleanup

What this PR does

• Pins the script used to install CRI-O.
• Pins GitHub action redhat-actions/push-to-registry to v2.5.

Why we need it:

Pinned dependencies reduce several security risks:

• They ensure that checking and deployment are all done with the same software, reducing deployment risks, simplifying debugging, and enabling reproducibility.
• They can help mitigate compromised dependencies from undermining the security of the project (in the case where you've evaluated the pinned dependency, you are confident it's not compromised, and a later version is released that is compromised).
• They are one way to counter dependency confusion (aka substitution) attacks, in which an application uses multiple feeds to acquire software packages (a "hybrid configuration"), and attackers fool the user into using a malicious package via a feed that was not expected for that package.

More information refer to ossf

Which issue(s) this PR fixes:

Relates to #653

Does this PR have test?

N/A

Special notes for your reviewer:

Once this PR is merged, there is only one valid item dependency to be pinned (as per reported by ossf scorecard), which is the build base image:
https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/Dockerfile#L16

This item will be remediated in the coming weeks.

The ossf scorecard also reported a few items within the vendor folder, but I am treating it as false positive (ossf/scorecard#1095).

Does this PR introduce a user-facing change?

NONE

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: pjbgf, saschagrunert

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [pjbgf,saschagrunert]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[saschagrunert]

/test pull-security-profiles-operator-test-e2e

[codecov-commenter]

Codecov Report

Merging #749 (d453bff) into main (c1ec914) will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##             main     #749   +/-   ##
=======================================
  Coverage   54.03%   54.03%           
=======================================
  Files          42       42           
  Lines        4129     4129           
=======================================
  Hits         2231     2231           
  Misses       1831     1831           
  Partials       67       67           

[pjbgf]

/test pull-security-profiles-operator-test-e2e

[pjbgf]

/test pull-security-profiles-operator-test-e2e

[pjbgf]

/test pull-security-profiles-operator-test-e2e

[saschagrunert]

/test pull-security-profiles-operator-test-e2e

[saschagrunert]

/test pull-security-profiles-operator-test-e2e