Drop Linux capabilities

[ArthurSens]

Description

This is part of the initiative to tighten security in kube-prometheus

We're reducing the attack surface by dropping all Linux capabilities of all components, just keeping CAP_SYS_TIME for node-exporter because it is required by the time collector.

Following remediation docs from https://hub.armo.cloud/docs/c-0055

Type of change

What type of changes does your code introduce to the kube-prometheus? Put an x in the box that apply.

• CHANGE (fix or feature that would cause existing functionality to not work as expected)
• FEATURE (non-breaking change which adds functionality)
• BUGFIX (non-breaking change which fixes an issue)
• ENHANCEMENT (non-breaking change which improves existing functionality)
• NONE (if none of the other choices apply. Example, tooling, build system, CI, docs, etc.)

Changelog entry

Please put a one-line changelog entry below. Later this will be copied to the changelog file.

Reduce attack surface by dropping unnecessary Linux capabilities