Enforce read-only PostgreSQL permissions for kubeproxyuser_ro

[damccorm]

Enforces strict read-only permissions for the kubeproxyuser_ro PostgreSQL role used by the Beam Metrics Grafana datasource:

• Revokes CREATE on schema public from PUBLIC and kubeproxyuser_ro, and grants only USAGE on schema public.
• Revokes all write/DDL table privileges (INSERT, UPDATE, DELETE, TRUNCATE, REFERENCES, TRIGGER) on tables in schema public from PUBLIC and kubeproxyuser_ro, granting only SELECT to kubeproxyuser_ro.
• Sets default_transaction_read_only = on on kubeproxyuser_ro in postgres/init.sql and during metrics database initialization.

[damccorm]

R: @Amar3tto

[github-actions]

Assigning reviewers:

R: @jrmccluskey added as fallback since no labels match configuration

Note: If you would like to opt out of this review, comment assign to next reviewer.

Available commands:

• stop reviewer notifications - opt out of the automated review tooling
• remind me after tests pass - tag the comment author after tests pass
• waiting on author - shift the attention set back to the author (any comment or push by the author will return the attention set to the reviewers)

The PR bot will only process comments in the main thread (not review comments).

[github-actions]

Stopping reviewer notifications for this pull request: review requested by someone other than the bot, ceding control. If you'd like to restart, comment assign set of reviewers