Allow che administrators to enable container build capabilities for developers workspaces

[l0rd]

Is your enhancement related to a problem? Please describe

Today it's only possible to add the capability through an attribute in a devfile and this is not portable.

Describe the solution you'd like

Add to the CheCluster a field to enable the container build capabilties and update the dashboard to consume it at workspace startup:

spec:
  devEnvironments:
    disableContainerBuildCapabilities: true # initially the default is `true` 
                                            # but will be switched to `false` as soon
                                            # as #21764 sub-tasks are completed.

Release Notes Text

An administrator can enable container builds using devEnvironments.disableContainerBuildCapabilities: true in CheCluster configuration. This allow using podman build on any workspace (adding the attribute controller.devfile.io/scc: container-build in a Devfile is not required anymore) .

[tolusha]

@l0rd
Could you help with CheCluster CR fields?

[l0rd]

spec:
  devEnvironments:
    disableContainerBuildCapabilities: false # <== default is false

[ibuziuk]

from the semantics perspective it would be better to drop the negative connotation (disable field set to false) and use EnableContainerBuildCapabilities set to true by default:

spec:
  devEnvironments:
    enableContainerBuildCapabilities: true # <== default is true

[l0rd]

I am ok with both but in the past we have been trying to stick with the following convention: omitting a boolean field corresponds to setting it to false. That's because it's super simple to implement and it make sense from a logical point of view.

[l0rd]

I have added the full list of tasks to automate the enabling of the workspaces container build capabilities in #21764.
Once all subtasks are completed the CheCluster.devEnvironments should have the following new fields defaults:

spec:
  devEnvironments:
    disableContainerBuildCapabilities: false # initially the default is `true`
    containerBuildConfiguration:
       openShiftSecurityContextConstraint: 'container-build'
       containerOverrides: {"securityContext":{"capabilities":{"add": ["SETGID", "SETUID"]}}}
       podOverrides: {"spec": {"securityContext": {"allowPrivilegeEscalation": false}}}

[max-cx]

Sync'd with Red Hat JIRA https://issues.redhat.com/browse/CRW-3637