Clarify Brupop's port requirements

[stockholmux]

Discussed in bottlerocket-os/bottlerocket#3600

^{Originally posted by landbaychrisburrell November 16, 2023}
Hi

My understanding is that most of the interactions between the operator and the BottleRocket OS happen by updating the Shadow resources - as such, there is presumably zero ports required to be open - and so locking down the namespace with a policy that prevents all comms for pods into the operator's namespace would be fine?

[stockholmux]

closed by #419