CNI file permissions based on CIS Benchmarks

[missa-wndrvr]

CNI-related CIS Benchmarks include:

1.1.9 Ensure that the Container Network Interface file
permissions are set to 600 or more restrictive.

Tests:

• Running "make test" in 'cni-plugin' directory successfully
• Delpoying Calico-node and Calico-Kube-controllers pods successfully
• Ensure /etc/cni/net.d/10-calico.conflist file permissions is set to 600
• Ensure Calico plugin is listed under '/opt/cni/bin/'

Related issues/PRs

#7461

Todos

• [ x] Tests
• Documentation
• Release note

Release Note

TBD

Reminder for the reviewer

Make sure that this PR has the correct labels and milestone set.

Every PR needs one docs-* label.

• docs-pr-required: This change requires a change to the documentation that has not been completed yet.
• docs-completed: This change has all necessary documentation completed.
• docs-not-required: This change has no user-facing impact and requires no docs.

Every PR needs one release-note-* label.

• release-note-required: This PR has user-facing changes. Most PRs should have this label.
• release-note-not-required: This PR has no user-facing changes.

Other optional labels:

• cherry-pick-candidate: This PR should be cherry-picked to an earlier release. For bug fixes only.
• needs-operator-pr: This PR is related to install and requires a corresponding change to the operator.

[CLAassistant]

All committers have signed the CLA.

[mazdakn]

/sem-approve

[caseydavenport]

Looks like a handful of tests failing in the CNI package with errors like these:

------------------------------36:09
• Failure [0.960 seconds]36:09
CNI installation tests36:09
/go/src/github.com/projectcalico/calico/cni-plugin/pkg/install/install_test.go:15836:09
  should use CNI_NETWORK_CONFIG_FILE over CNI_NETWORK_CONFIG [It]36:09
  /go/src/github.com/projectcalico/calico/cni-plugin/pkg/install/install_test.go:32136:09
 36:09
  failed to read file /tmp/cni-install-ut-4151388086/net.d/10-calico.conflist36:09
  Unexpected error:36:09
      <*fs.PathError | 0xc00059e2d0>: 36:09
      open /tmp/cni-install-ut-4151388086/net.d/10-calico.conflist: permission denied36:09
      {36:09
          Op: "open",36:09
          Path: "/tmp/cni-install-ut-4151388086/net.d/10-calico.conflist",36:09
          Err: <syscall.Errno>0xd,36:09
      }36:09
  occurred36:09
--36:13
••36:13
------------------------------36:13
• Failure [0.828 seconds]36:13
CNI installation tests36:13
/go/src/github.com/projectcalico/calico/cni-plugin/pkg/install/install_test.go:15836:13
  copying /calico-secrets36:13
  /go/src/github.com/projectcalico/calico/cni-plugin/pkg/install/install_test.go:36236:13
    Should copy a non-hidden file [It]36:13
    /go/src/github.com/projectcalico/calico/cni-plugin/pkg/install/install_test.go:37736:13
 36:13
    Unexpected error:36:13
        <*fs.PathError | 0xc000614a80>: 36:13
        open /tmp/cni-install-ut-2865909681/net.d/10-calico.conflist: permission denied36:13
        {36:13
            Op: "open",36:13
            Path: "/tmp/cni-install-ut-2865909681/net.d/10-calico.conflist",36:13
            Err: <syscall.Errno>0xd,