docs(security): add opt-in Manual installPlanApproval overlays (OSPRH-32422 / FIND-010) (#76)

The shipped subscriptions for ESO, VSO, and openshift-gitops-operator use
installPlanApproval: Automatic — operators upgrade automatically when the
catalog publishes a new version to the channel.  This is intentional: it
keeps the deployment simple and avoids the operational overhead of an
in-cluster Job that must approve every new InstallPlan.

For deployments that require stricter change-control over operator
upgrades (e.g. production environments where every component version
must be reviewed before installation), opt-in overlay components are
provided:

  components/secrets/external-secrets-operator/manual-approval/
  components/secrets/vault-secrets-operator/manual-approval/

These components switch installPlanApproval to Manual and pin a
startingCSV.  Consumers include them after the base subscription
component and update startingCSV whenever they want to advance the
operator version.  Administrators must then approve the resulting
InstallPlan (manually or via automation) before OLM installs the
new CSV.

The openshift-gitops-operator subscription is excluded from this
pattern: it is applied by the Ansible bootstrap before ArgoCD exists,
so no in-cluster Job can approve a Manual InstallPlan at that stage.
Version gating for that operator is handled via the
openshift_gitops_deploy_git_ref pin in the automation repo.

Addresses OWASP K8s Top 10 K07 (Vulnerable/Unverified Components).

Co-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

Author: pinikomarov

components/secrets/external-secrets-operator/manual-approval/kustomization.yaml

@@ -0,0 +1,44 @@
+---
+# Opt-in overlay: switch the ESO subscription to Manual installPlanApproval.
+#
+# Include this component AFTER the base ESO component (community or redhat)
+# to override installPlanApproval from Automatic to Manual and pin a
+# specific startingCSV.
+#
+# Manual approval means OLM will not install a new operator version until
+# an administrator (or automation) explicitly approves the InstallPlan.
+# This provides change-control over operator upgrades at the cost of
+# requiring an approval step on every new version.
+#
+# NOTE: When using Manual approval you must ensure InstallPlans are approved
+# before the operator can install or upgrade. Options:
+#   - Approve manually: oc patch installplan <name> -n <ns> --type merge
+#       -p '{"spec":{"approved":true}}'
+#   - Or implement an automated approval Job (see the pattern in
+#     components/utilities/approve-installplan for the openstack-operator).
+#
+# Usage in a consumer kustomization:
+#   components:
+#     - https://github.com/openstack-k8s-operators/gitops/components/secrets/external-secrets-operator/redhat?ref=<tag>
+#     - https://github.com/openstack-k8s-operators/gitops/components/secrets/external-secrets-operator/manual-approval?ref=<tag>
+#
+# Remember to update startingCSV to the version currently running in your
+# cluster before switching to Manual. Query with:
+#   oc get subscription openshift-external-secrets-operator -n external-secrets-operator \
+#     -o jsonpath='{.status.currentCSV}'
+
+# ---- EXAMPLE — uncomment and fill in before using ----
+#
+# apiVersion: kustomize.config.k8s.io/v1alpha1
+# kind: Component
+# patches:
+#   - target:
+#       kind: Subscription
+#       name: external-secrets-operator
+#     patch: |-
+#       - op: replace
+#         path: /spec/installPlanApproval
+#         value: Manual
+#       - op: add
+#         path: /spec/startingCSV
+#         value: openshift-external-secrets-operator.v<VERSION>   # replace with current CSV

components/secrets/vault-secrets-operator/manual-approval/kustomization.yaml

@@ -0,0 +1,33 @@
+---
+# Opt-in overlay: switch the VSO subscription to Manual installPlanApproval.
+#
+# Include this component AFTER the base VSO component to override
+# installPlanApproval from Automatic to Manual and pin a specific startingCSV.
+#
+# See components/secrets/external-secrets-operator/manual-approval/kustomization.yaml
+# for full usage notes and approval options.
+#
+# Query your currently installed CSV:
+#   oc get subscription vault-secrets-operator -n openshift-operators \
+#     -o jsonpath='{.status.currentCSV}'
+#
+# Usage in a consumer kustomization:
+#   components:
+#     - https://github.com/openstack-k8s-operators/gitops/components/secrets/vault-secrets-operator?ref=<tag>
+#     - https://github.com/openstack-k8s-operators/gitops/components/secrets/vault-secrets-operator/manual-approval?ref=<tag>
+
+# ---- EXAMPLE — uncomment and fill in before using ----
+#
+# apiVersion: kustomize.config.k8s.io/v1alpha1
+# kind: Component
+# patches:
+#   - target:
+#       kind: Subscription
+#       name: vault-secrets-operator
+#     patch: |-
+#       - op: replace
+#         path: /spec/installPlanApproval
+#         value: Manual
+#       - op: add
+#         path: /spec/startingCSV
+#         value: vault-secrets-operator.v<VERSION>   # replace with current CSV