feat: watch file update on executor config

[binbin-li]

Description

What this PR does / why we need it:

1. Add file watcher on the executor config file so that Ratify server could pick up the latest configuration and generate a new executor.
2. Update server struct by replacing executor field with a getExecutor function callback so that server could always get the latest executor.
3. Update TLSCertWatcher by replacing the RWMutex with atomic.Pointer to improve the performance while maintaining the thread safety.

Which issue(s) this PR fixes (optional, using fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when the PR gets merged):

Fixes #

Type of change

Please delete options that are not relevant.

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Helm Chart Change (any edit/addition/update that is necessary for changes merged to the main branch)
• This change requires a documentation update

How Has This Been Tested?

Added unit test.

Checklist:

• Does the affected code have corresponding tests?
• Are the changes documented, not just with inline documentation, but also with conceptual documentation such as an overview of a new feature, or task-based documentation like a tutorial? Consider if this change should be announced on your project blog.
• Does this introduce breaking changes that would require an announcement or bumping the major version?
• Do all new files have appropriate license header?

Post Merge Requirements

• MAINTAINERS: manually trigger the "Publish Package" workflow after merging any PR that indicates Helm Chart Change

[codecov]

Codecov Report

Attention: Patch coverage is 80.85106% with 18 lines in your changes missing coverage. Please review.

Project coverage is 74.07%. Comparing base (134acce) to head (6a42675).
Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
internal/httpserver/server.go	58.33%	8 Missing and 2 partials ⚠️
internal/httpserver/config/config.go	86.66%	6 Missing and 2 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2278      +/-   ##
==========================================
- Coverage   74.09%   74.07%   -0.03%     
==========================================
  Files         121      121              
  Lines        6737     6789      +52     
==========================================
+ Hits         4992     5029      +37     
- Misses       1542     1553      +11     
- Partials      203      207       +4     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull Request Overview

This PR implements dynamic configuration updates for the executor by adding file watcher support for both TLS certificate files and executor configuration. The changes include updating the TLS certificate watcher to use atomic pointers for improved performance and thread safety, refactoring the server structure to use a getExecutor callback for always retrieving the latest executor, and integrating a config watcher in the server startup process. Additionally, some deployment and configuration adjustments were made for security and provider updates.

Reviewed Changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
internal/httpserver/tlssecret/certwatcher_test.go	Updated tests to use NewWatcher and atomic pointer access for TLS secrets.
internal/httpserver/tlssecret/certwatcher.go	Refactored to replace RWMutex with atomic pointers and added logging for fsnotify events.
internal/httpserver/server.go	Replaced static executor field with a getExecutor callback and integrated a config watcher.
internal/httpserver/handlers_test.go & handlers.go	Updated executor API calls to reference the new getExecutor callback.
internal/httpserver/config/config_test.go & config.go	Introduced a new Watcher for executor configuration and updated related tests.
deployments/ratify-gatekeeper-provider/templates/deployment.yaml	Changed readOnlyRootFilesystem to true for enhanced security.
configs/config.json	Updated registry configuration settings.

[shizhMSFT]

LGTM