psp: Make the restrictive policy as the first on the list

[surajssd]

The policy order of PSP has two methods of selecting a PSP for
applications:

1. If a PSP allows the pod specification as is without a mutation, then
   that PSP is used.
2. If the above condition fails, then the fist PSP is chosen from an
   allowed-PSP list, and the pod is mutated accordingly.

In Lokomotive's case the general cluster-wide PSP for apps that don't
ship PSP is the minimal restrictive PSP. So we need to ensure that it is
on top of the list for selection not bottom.

[invidian]

Please add some reasoning for the proposed change.

[surajssd]

Please add some reasoning for the proposed change.

Yep, on it. I wanted to ensure my hypothesis works.

[invidian]

Yep, on it. I wanted to ensure my hypothesis works.

Thanks @surajssd... But I still struggle to understand the need for this PR. Can we have a test case, which will fail without the proposed patch to show the need of it on the patch itself? I think there is some critical information missing here.

Right now we only have one policy allowed in all namespaces, which is zz-minimal. If I deploy workload X, it must use some PSP, so it will either try to use zz-minimal or it will fail if this policy is too restrictive. If I create a policy X for my workload and allow it to use it, then the controller must choose between the policy X and zz-minimal for my workload. In such case, policy X will always be preferred, as we on purpose add zz- prefix to our policies, to entourage users to roll their own policies, which might be better tailored to their needs.

See also #293