Roll out PSS Restricted profile.

[sengi]

We currently enforce the PSS baseline profile.

We want tighten that up to Restricted where possible (e.g. apps namespace), so that we don't have to worry about regressions in container permissions — i.e. application containers unintentionally/unnecessarily being granted system privileges in future.

In other words, this:

• prevents a set of potential misconfigurations in future
• helps to "lock in" the benefits of the least-privilege configuration that we already have

We still have a couple of NFS clients (e.g. asset-manager), so we might need to work around that temporarily and/or pay down that tech debt and switch them to S3.

[sengi]

Ah nuts, auto-closed this by mistake somehow or other.

[sengi]

It's not rolled out until we're in enforcement mode.

Should be mostly just trivial template fixes, plus the not-so-trivial NFS question.