🐛 (fix): update PSA versions to match Kubernetes API version

[camilamacedo86]

In this commit, a new Makefile target update-k8s-values was created to automatically update the
pod-security.kubernetes.io/*-version values (enforceVersion, auditVersion, warnVersion)
in the Helm chart's values.yaml file.

These values now align with the Kubernetes API version defined in go.mod, instead of using latest. This ensures better compatibility and avoids issues with unsupported versions in Kubernetes PSA.

[kevinrizza]

@camilamacedo86 I think this change looks okay, but if we're going to touch these anyway, does it make sense for us to revisit #2906 at this point? We've default to baseline enforcement for the last ~2 years. At this point I expect that everyone should be using catalog binaries that can handle restricted enforcement

Maybe not part of this pr, but should we create an issue?

[camilamacedo86]

Hi @kevinrizza

Thank you for the help!
Regards: #3524 (comment)
Just to confirm my understanding, we should be using restricted instead of baseline.
We can do that in a follow up, because we need to cherry-pick it for old OCP versions.
But I will look on that.

[perdasilva]

Thank you ^^

[anik120]

/lgtm

At this point I expect that everyone should be using catalog binaries that can handle restricted enforcement

Note that we'll have to dig up why exactly the catalog binaries weren't able to handle the restricted environment, to confirm to ourselves that our customers are off of that issue (I can't remember off the top of my head what exactly the issue was)

[jianzhangbjz]

Based on https://redhat-internal.slack.com/archives/C06KP34REFJ/p1741224828143489?thread_ts=1739880491.760029&cid=C06KP34REFJ, we are fine to leave our namespace manifest with latest since it doesn't appear hypershift is using it, "latest" means the-version-of-the-control-plane-that-is-running-psa-logic-for-this-namespace. So these pinning PRs appear not needed. So, we should revert this PR.

we should revert this change.