Release v0.21.0

[stefanprodan]

This prerelease comes with changes to the base image used to build and
run the controller, replacing Debian Unstable (Sid) with Alpine 3.15.
The controller is now statically built and includes libgit2 along with
its main dependencies.

The controller container images are signed with
Cosign and GitHub OIDC,
and a Software Bill of Materials in SPDX format has been published on the release page.

Starting with this version, the controller deployment conforms to the
Kubernetes restricted pod security standard:

• all Linux capabilities were dropped
• the root filesystem was set to read-only
• the seccomp profile was set to the runtime default
• run as non-root was enabled
• the filesystem group was set to 1337
• the user and group ID was set to 65534

Breaking changes:

• The use of new seccomp API requires Kubernetes 1.19.
• The controller container is now executed under 65534:65534 (userid:groupid).
  This change may break deployments that hard-coded the user ID of 'controller' in their PodSecurityPolicy.

[stefanprodan]

Talk to @pjbgf and we decided to delay the release as fuzzing requires changes to the static build.

[stefanprodan]

We decided to postpone the libgit2 1.3.0 upgrade from #557 till the next release.

[pjbgf]

@stefanprodan can you please update the description with "replacing Debian Unstable (Sid) with Debian Bookworm alpine:3.15"?