Tighten tcib sudoers rules

[rabi]

Drop the unneeded broad sudoers entries from the ansible-tests, horizontest, rally, and tobiko images, restrict Tempest to package installation, and replace the kolla wildcard rule with explicit helper commands.

Keep the MariaDB bootstrap environment needed by kolla_security_reset so the tighter kolla allowlist does not break bootstrap.

Depends-On: openstack-k8s-operators/mariadb-operator#537
jira: OSPRH-34490

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: rabi

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [rabi]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[centosinfra-prod-github-app]

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/buildset/52ea50a5a9d84b6b9c12f8ca73568acd

✔️ tcib-openstack-meta-content-provider-master SUCCESS in 2h 08m 02s
❌ tcib-crc-podified-edpm-baremetal-master FAILURE in 1h 24m 19s
❌ tcib-podified-multinode-edpm-deployment-crc-master FAILURE in 1h 12m 20s
❌ tcib-podified-multinode-edpm-deployment-crc-tobiko-master FAILURE in 1h 14m 14s

[centosinfra-prod-github-app]

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/buildset/81cb64ce0cc04d92a0dce1b0c6665266

✔️ tcib-openstack-meta-content-provider-master SUCCESS in 2h 14m 51s
❌ tcib-crc-podified-edpm-baremetal-master FAILURE in 1h 25m 16s
❌ tcib-podified-multinode-edpm-deployment-crc-master FAILURE in 1h 13m 35s
❌ tcib-podified-multinode-edpm-deployment-crc-tobiko-master FAILURE in 1h 13m 44s

[rabi]

recheck

[centosinfra-prod-github-app]

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/buildset/98775789b0314c21b4e6e1d2dabaf2bb

✔️ tcib-openstack-meta-content-provider-master SUCCESS in 3h 05m 14s
❌ tcib-crc-podified-edpm-baremetal-master NODE_FAILURE Node(set) request 099-0000166131 failed in 0s
❌ tcib-podified-multinode-edpm-deployment-crc-master FAILURE in 1h 54m 03s
❌ tcib-podified-multinode-edpm-deployment-crc-tobiko-master NODE_FAILURE Node(set) request 099-0000166133 failed in 0s

[rabi]

recheck