k8sSearch: exclude secrets with scopes that are not requested

[nightkr]

Affected Stackable version

nightly

Current and expected behavior

Currently, the k8sSearch backend treats requested scopes as a minimum bound. A volume that requests pod will happily be supplied a secret secret that provides pod,node, allowing the pod to impersonate someone else.

Possible solution

k8sSearch should reject secrets that specify unrequested scopes.

Additional context

No response

Environment

No response

Would you like to work on fixing this bug?

None