Document tested K8sPEASS permission attack paths

[carlospolop]

Summary

• document K8sPEASS read-only permission enumeration and severity interpretation
• map every active critical/high K8sPEASS permission family to a concrete attack path
• keep controller-dependent and unverified paths at medium instead of presenting them as true positives
• add reproduced Service/EndpointSlice, NetworkPolicy, ValidatingAdmissionPolicyBinding, ConfigMap, ClusterTrustBundle, PersistentVolume, direct binding, CSR, and non-resource debug checks

Validation

• reproduced permission chains with dedicated identities and negative controls on disposable Minikube Kubernetes v1.37.0 profiles
• reproduced NetworkPolicy deny/patch/restore using Calico
• isolated nodes/proxy no-grant, get-only WebSocket exec, and create-only /run paths
• verified authorized-but-unserved API and /logs grants are not counted as active high findings
• MDBOOK_BOOK__LANGUAGE=en mdbook build (passes; existing unrelated warnings only)
• git diff --check

All K8sPEASS Minikube profiles, Docker containers, generated book files, and temporary test evidence were removed after validation.