[Pick #3489] Use restricted namespace for opensource calico-apiserver (v1.35)

[mihivagyok]

• use restricted namespace for opensource apiserver
• when hostNetwork is required, use PSSPrivileged namespace label
• cherry-pick of Use restricted namespace for opensource apiserver #3489

Description

For PR author

• Tests for change.
• If changing pkg/apis/, run make gen-files
• If changing versions, run make gen-versions

For PR reviewers

A note for code reviewers - all pull requests must have the following:

• Milestone set according to targeted release.
• Appropriate labels:
  • kind/bug if this is a bugfix.
  • kind/enhancement if this is a a new feature.
  • enterprise if this PR applies to Calico Enterprise only.

[caseydavenport]

/sem-approve