Boost ReadOnlyRootFilesystem rule score from 1 to 3

The readOnlyRootFilesystem rule was scored at 1 point, the floor for a
positive hardening rule. An immutable root filesystem is a meaningful
defense-in-depth control: it raises attacker cost by preventing malicious
binaries from being written into PATH and frustrates post-exploitation
tooling drops (for example linpeas or peirates) after a remote shell.

Raise it to 3, matching the other top container-hardening rules
(ServiceAccountName, ApparmorAny). This keeps it at or below RunAsNonRoot's
weight, which remains the higher-priority control as it is generally a
bigger deal than a read-only rootfs.

Updates the affected score assertion in ruleset_test.go (the manifest with
readOnlyRootFilesystem + runAsNonRoot now totals 4 instead of 2).

Closes #572

Signed-off-by: arpitjain099 <arpitjain099@gmail.com>

Author: arpitjain099

pkg/ruler/ruleset.go

@@ -63,7 +63,7 @@ func NewRuleset(logger *zap.SugaredLogger, ruleIDs ...string) (*Ruleset, error)
 			Selector:  "containers[] .securityContext .readOnlyRootFilesystem == true",
 			Reason:    "An immutable root filesystem can prevent malicious binaries being added to PATH and increase attack cost",
 			Kinds:     []string{"Pod", "Deployment", "StatefulSet", "DaemonSet"},
-			Points:    1,
+			Points:    3,
 			Advise:    3,
 		},
 		{

pkg/ruler/ruleset_test.go

@@ -191,8 +191,8 @@ spec:
 
 			report := reports[0]
 
-			if report.Score != 2 {
-				t.Errorf("Got score: %d, expected: 2", report.Score)
+			if report.Score != 4 {
+				t.Errorf("Got score: %d, expected: 4", report.Score)
 			}
 
 		})