Harden scanner extra volume handling

[sozercan]

Motivation

• The manager config previously allowed components.scanner.volumes to include hostPath volumes which were mounted into the scanner container at the host path, enabling disclosure of host filesystem data if the ConfigMap could be modified.

Description

• Reject hostPath-backed volumes from components.scanner.volumes by logging an error and skipping them to prevent arbitrary hostPath mounts into the scanner container.
• Introduce a fixed internal base directory "/run/eraser.sh/scanner-extra" and mount accepted non-hostPath extra volumes under "/run/eraser.sh/scanner-extra/<volume-name>" as read-only to avoid mirroring host paths.
• Only validated (non-hostPath) volumes are appended to the job template's Spec.Volumes and mounted into the scanner container; changes are localized to controllers/imagecollector/imagecollector_controller.go.

Testing

• Ran go test -run TestDoesNotExist ./controllers/imagecollector, which completed (package has no test files).
• Ran go test ./api/unversioned/..., which completed (packages have no test files).

---

Codex Task