Harden reboot-required and reboot pods

[moberghammer]

While running full-fleet reboot rounds (~34 nodes across two clusters) with nodedrain 0.0.10 we hit three failure modes that all trace back to the utility pods (reboot-required-*, reboot-*) being bare best-effort pods pinned via spec.nodeName:

1. OutOfpods probe failures on full nodes. spec.nodeName bypasses the scheduler, so kubelet admission rejects the pod outright when the node is at max-pods capacity — preemption never runs. This bites exactly during a serial fleet round: not-yet-rebooted nodes absorb the drained workloads, hit the pod cap, and then their own reboot-required probe fails (phase: Failed, reason: OutOfpods), stalling the round until an operator frees pod slots.
2. Leftover probe pods block the node's own drain. The pods declare no controller, and the drain helper refuses to evict pods without a controller ownerRef (cannot delete Pods that declare no controller).
3. Admission-policy warnings. No resource requests/limits fails common policies (e.g. Kyverno require-requests-limits), and best-effort pods are first in line for kubelet rejection.

Changes:

• Pods are now placed through the scheduler using a required node affinity on metadata.name (the existing tolerations already cover cordoned/control-plane nodes). A new optional config reboot.podPriorityClassName (default "", unchanged behavior) lets operators point at a PriorityClass so the pods can preempt lower-priority pods on full nodes.
• Both pods get a controller ownerReference to their target Node (same pattern as kubelet mirror pods) — satisfies the drain helper and garbage-collects pods for deleted nodes.
• Both pods get requests 10m/16Mi, limits 100m/32Mi.
• The deprecated container.apparmor.security.beta.kubernetes.io/shell annotation on the reboot pod is replaced with securityContext.appArmorProfile (field is GA since Kubernetes 1.30).

Trade-offs worth calling out: pod placement now depends on a working scheduler, and clusters running the OwnerReferencesPermissionEnforcement admission plugin may need the controller to hold delete permission on nodes for the ownerRef.

make test passes (envtest, k8s 1.34).

[SlyngDK]

I have added priorityClassName, resources and apparmor in #45

@moberghammer can you create an issue for the drain/garbage collect part, pretty hard to read from the description what the issue you are trying to resolve.