cmd/k8s-operator,docs/k8s: run tun mode proxies in privileged containers (#14262)

We were previously relying on unintended behaviour by runc where
all containers where by default given read/write/mknod permissions
for tun devices.
This behaviour was removed in https://github.com/opencontainers/runc/pull/3468
and released in runc 1.2.
Containerd container runtime, used by Docker and majority of Kubernetes distributions
bumped runc to 1.2 in 1.7.24 https://github.com/containerd/containerd/releases/tag/v1.7.24
thus breaking our reference tun mode Tailscale Kubernetes manifests and Kubernetes
operator proxies.

This PR changes the all Kubernetes container configs that run Tailscale in tun mode
to privileged. This should not be a breaking change because all these containers would
run in a Pod that already has a privileged init container.

Updates tailscale/tailscale#14256
Updates tailscale/tailscale#10814

Signed-off-by: Irbe Krumina <irbe@tailscale.com>

docs/k8s/proxy.yaml

@@ -53,6 +53,4 @@ spec:
         fieldRef:
           fieldPath: metadata.uid
     securityContext:
-      capabilities:
-        add:
-        - NET_ADMIN
+      privileged: true

docs/k8s/sidecar.yaml

@@ -35,6 +35,4 @@ spec:
         fieldRef:
           fieldPath: metadata.uid
     securityContext:
-      capabilities:
-        add:
-        - NET_ADMIN
+      privileged: true

docs/k8s/subnet.yaml

@@ -37,6 +37,4 @@ spec:
         fieldRef:
           fieldPath: metadata.uid
     securityContext:
-      capabilities:
-        add:
-        - NET_ADMIN
+      privileged: true