Enforce the Restricted Pod Security Standard

A security review found that Pods in travel run with the container defaults: as root, with every Linux capability and with privilege escalation allowed. From now on the namespace must enforce the restricted Pod Security Standard, and its Deployment invoice-pdf (an init container plus two containers) has to keep running under it.