Add timeout to policy evaluation

[jvanz]

To help the mitigation of the threat #2 of the threat model, the policy server should allow the operator define a timeout for the policy evaluation. If a policy takes more then the defined timeout, the request is rejected.

NOTE: This is an issue created from RFC discussing the admission control threat model. It's created to allow the Kubewarden team discuss the proposed mitigation further and start to work on each actionable item when possible

Actions

• Update policy-evaluator: feat: timeout protection policy-evaluator#224
• Update policy server: feat: policy timeout protection #389
• Update docs: Explain the timeout protection feature docs#157
• ~~ [ ] Blog post: blog post: introduce timeout protection kubewarden.io#165 ~~

[flavio]

I think there are basically two options:

• Implement a timer
• Try to use something fancy like the fuel concept built into wasmtime

[flavio]

I wonder if "timeout protection" is a good name for this feature 🤔

I think we should think about another one, because this is a bit confusing

[viccuad]

I'm having trouble finding a better wording for "if policy timeout reached, reject request".
Ideas: rejection by timeout, timeout exclusion.
I still prefer timeout protection.

[viccuad]

#389 got prematurely merged, #396 reverted it.

Re-opening card again. We would need to create a new PR analogous to #389.

[flavio]

reopening, there are other tasks that have to be done