Make least-privilege exemptions for ztunnel and install-cni pods

[mjnagel]

#699 currently has catch-all exemptions for the ztunnel and istio-cni pods. These exemptions should be slimmed down to just what is necessary for running these applications. All exemptions should have adequate descriptions to provide the "why".

[sgettys]

This is part of the ambient PR the minimum required exemptions for ztunnel and CNI are part of the ambient update to the istio package