app top level run as exclude

[bradleyjamrozik-origindigital]

bundle: allow apps alongside top-level run_as; apps ignore the setting

Changes

• Remove the validation error that blocked bundles with app resources
  from having a top-level run_as identity configured.
• Apps are not mutated by run_as (the API does not support it), so
  having run_as in the bundle is valid — the setting is simply skipped.
• Add unit tests confirming apps are not mutated and can coexist with
  jobs that do get run_as applied.
• Add acceptance test covering a bundle with an app and a service
  principal run_as identity.

Why

The previous validation was too strict: it rejected a valid
configuration where a user wants run_as on their jobs/pipelines and
also has an app in the same bundle. The app just ignores run_as, so
there's no reason to block the bundle from validating.

Solves Issue #5091

Tests

New unit tests in run_as_test.go and acceptance test in
acceptance/bundle/run_as/app_different/.

[github-actions]

An authorized user can trigger integration tests manually by following the instructions below:

Trigger:
go/deco-tests-run/cli

Inputs:

• PR number: 5714
• Commit SHA: 0d6696a43362a76a439ae35006d0e48e93990c5f

Checks will be approved automatically on success.

[github-actions]

Approval status: pending

/acceptance/bundle/ - needs approval

5 files changed
Suggested: @denik
Also eligible: @janniklasrose, @pietern, @shreyas-goenka, @anton-107, @andrewnester, @lennartkats-db

/bundle/ - needs approval

Files: bundle/config/mutator/resourcemutator/run_as.go, bundle/config/mutator/resourcemutator/run_as_test.go
Suggested: @denik
Also eligible: @janniklasrose, @pietern, @shreyas-goenka, @anton-107, @andrewnester, @lennartkats-db

General files (require maintainer)

Files: NEXT_CHANGELOG.md
Based on git history:

• @denik -- recent work in ./, bundle/config/mutator/resourcemutator/

_{Any maintainer (@andrewnester, @anton-107, @denik, @pietern, @shreyas-goenka, @simonfaltum, @renaudhartert-db) can approve all areas.
See OWNERS for ownership rules.}