Decide if license constraint is valid for OpenShift deployments

[ppawlowski]

Currently, we require one to apply a license when installing FlowFuse on OpenShift. In return, some pod security context are removed which makes deployment possible on vanilla OpenShift cluster.
However, such limitation can be bypassed by applying proper anyuid Security Context Constraint to the editors service account:

oc adm policy add-scc-to-user anyuid -z editors

The goal of this issue is to decide if we want to keep the current license requirement for OpenShift installations.

[hardillb]

The driver currently includes the following code:

driver-k8s/kubernetes.js

Lines 186 to 192 in d2f6092

	if (this._app.config.driver.options?.podSecurityContext) {
	localPod.spec.securityContext = this._app.config.driver.options.podSecurityContext
	this._app.log.info(`[k8s] Using custom PodSecurityContext ${JSON.stringify(this._app.config.driver.options.podSecurityContext)}`)
	} else if (this._app.license.active() && this._cloudProvider === 'openshift') {
	localPod.spec.securityContext = {}
	this._app.log.info('[k8s] OpenShift, removing PodSecurityContext')
	}

This allows a user at helm install time (when the cloudProvider flag is inserted into the driver.options section of the flowfuse.yml file) to remove the Node-RED instance Deployment pod security context. This means that the platform will create it's own with random uid/gid values (very high numbers).

It also allows the user to pass in a pod security context overriding the default values. But this is an either or situation.

Recent work with a OpenShift user has uncovered a command that will remove the requirements for a custom pod security context for the Node-RED instances.

oc adm policy add-scc-to-user anyuid -z editors

(This adds a policy to the ServiceAccount the Node-RED instances run under to allow the standard uid/gid in the pod)

The original reason for the license requirement was the extra support overhead with dealing with OpenShift, but recent customer interactions suggest that is is causing more support work rather than offsetting it (especially with trials before contracts are signed).

Given that there are now 2 work arounds that remove the need for a license specifically on OpenShift I propose we remove the app.license.active() check and document the command above.

@ZJvandeWeg @knolleary any objections?