What type of PR is this?

/kind feature

What this PR does / why we need it:

Goal: in most cases, setting just the pod-security enforce level on a namespace should give warning on workload resource creation & update, rather than requiring both warn & enforce to be set.

When the pod-security enforce level is set, but the warn version is not set (and the default is less-restrictive), then default the warn level to the enforce level.

I wasn't sure exactly what the right behavior was for the version, so I went with this:

• when defaulting warn to enforce, also default the warn-version to the enforce-version

If only enforce and warn-version but not warn is set, should warn still be defaulted? I went with yes, but kept the warn-version.

Special notes for your reviewer:

I think we've discussed this change in the past. The issue is that if a defaulting admission controller causes a workload to pass, then this could lead to erroneous warnings. This is not the common case, and can easily be bypassed by setting the warn level to privileged across all namespaces. I'd prefer to optimize for the common case here.

Does this PR introduce a user-facing change?

Pod Security admission: the pod-security `warn` level will now default to the `enforce` level.

/sig auth security
/milestone v1.26

/assign @liggitt