Harden Kubernetes IaC for vote, worker, result (Sysdig Best Practices)

[higakikeita]

This pull request applies security best practices to the Kubernetes deployment manifests for the vote, worker, and result components of the example-voting-app.

These changes are part of the Sysdig Technical Assessment – Phase A/B and are informed by the IaC scanning results via sysdig-cli-scanner.

✅ Improvements made:

• Set runAsNonRoot: true and dropped all capabilities
• Enabled readOnlyRootFilesystem for all containers
• Added resources.limits and resources.requests for CPU and memory
• Introduced runAsUser, runAsGroup, and fsGroup to improve security context isolation

🛡️ Benefit:

These changes reduce container privileges and follow the Sysdig Best Practices for Kubernetes workloads. As a result, future IaC scans are expected to PASS or show reduced high-risk controls.

---

Tested with:

• sysdig-cli-scanner v1.22.3 (Docker) + v1.23.x (IaC)
• GitHub Actions (see workflow .github/workflows/sysdig-scan.yml)

Let me know if further adjustments are needed. Thank you!