adding a new policy that allows scratch and root policy exceptions

[acornett21]

Motivation

Some partners need to run containers as both root and scratch for some of their product(s). Currently, we only allow for one of these exceptions at a time.

Explanation

This PR creates a net new Policy that runs a subset of checks, excluding any checks that do not appear in the current root and current scratch policy. Some existing policy names/variables were also refactored to provide better clarity.

Testing

Aside from the unit test updates, this was tested in stage with project 668ed5d57f921e72f6431c4c and below are the results.

{
    "image": "quay.io/acornett/scratch-root-passes:v1.0.0",
    "passed": true,
    "test_library": {
        "name": "github.com/redhat-openshift-ecosystem/openshift-preflight",
        "version": "unknown",
        "commit": "unknown"
    },
    "results": {
        "passed": [
            {
                "name": "HasLicense",
                "elapsed_time": 0,
                "description": "Checking if terms and conditions applicable to the software including open source licensing information are present. The license must be at /licenses"
            },
            {
                "name": "HasUniqueTag",
                "elapsed_time": 0,
                "description": "Checking if container has a tag other than 'latest', so that the image can be uniquely identified."
            },
            {
                "name": "LayerCountAcceptable",
                "elapsed_time": 0,
                "description": "Checking if container has less than 40 layers.  Too many layers within the container images can degrade container performance."
            },
            {
                "name": "HasRequiredLabel",
                "elapsed_time": 0,
                "description": "Checking if the required labels (name, vendor, version, release, summary, description) are present in the container metadata."
            }
        ],
        "failed": [],
        "errors": []
    }
}

Additional Info

More info and business approval for a new policy can be found in

• JIRA: EET-4101

[dcibot]

from change #1184:

• SUCCESS https://www.distributed-ci.io/jobs/a8957a27-bb29-4957-971c-5b20da59e555/jobStates

[coveralls]

coverage: 84.447% (+0.05%) from 84.397%
when pulling 87367e0 on acornett21:root_plus_scratch_policy
into c10fda5 on redhat-openshift-ecosystem:main.

[dcibot]

from change #1184:

• SUCCESS https://www.distributed-ci.io/jobs/680477ea-c291-4e2c-b18c-71a7eb066482/jobStates

[komish]

/lgtm

[bcrochet]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: acornett21, bcrochet, komish

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [acornett21,bcrochet,komish]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment