fix: add NetworkPolicy for DSP apiserver pod self traffic

[gregsheremeta]

Description of your changes:

The DSP apiserver implements TLS by relying on the OpenShift service cert signer. In order to get this to work nicely with our openshift-oauth sidecar, we set the Kubernetes service as the upstream for the oauth container. This means that all incoming traffic to DSP goes like this:
client -> DSP service -> DSP oauth -> DSP service -> DSP apiserver
DSP oauth and DSP apiserver are in the same pod. We haven't explicitly created a NetworkPolicy to allow that, but it works on AWS and OpenStack-based clusters. For some yet to be determined reason, it doesn't work on IBM / Calico / Secure-By-Default clusters.

Add a NetworkPolicy entry to allow the DSP pod to talk to itself on 8888 and 8887. This fixes the issue where DSP(oauth) can't talk to DSP(apiserver) via the service (that fronts both containers / the pod).

The issue resolved by this Pull Request:

Resolves https://issues.redhat.com/browse/RHOAIENG-14571

Testing instructions

Provision a managed IBM Cloud OpenShift with SBD enabled.
Install the master release of DSPO. Create a DSPA. Verify that you can't connect to this DSPA's route. You'll see timeout errors in the DSPA oauth containter log.
Update to this PR's build of DSPO. Create another DSPA. Verify that you CAN connect to this DSPA's route. You won't see timeout errors in the DSPA oauth containter log.

Checklist

• The commits are squashed in a cohesive manner and have meaningful messages.
• Testing instructions have been added in the PR body (for PRs involving changes that are not immediately obvious).
• The developer has manually tested the changes and verified that the changes work

[gregsheremeta]

/cc @jgarciao

[dsp-developers]

A new image has been built to help with testing out this PR: quay.io/opendatahub/data-science-pipelines-operator:pr-719
An OCP cluster where you are logged in as cluster admin is required.

To use this image run the following:

cd $(mktemp -d)
git clone git@github.com:opendatahub-io/data-science-pipelines-operator.git
cd data-science-pipelines-operator/
git fetch origin pull/719/head
git checkout -b pullrequest 1667e6d394c329c3f806783029abe3c5db78b448
oc new-project opendatahub
make deploy IMG="quay.io/opendatahub/data-science-pipelines-operator:pr-719"

More instructions here on how to deploy and test a Data Science Pipelines Application.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: jgarciao
Once this PR has been reviewed and has the lgtm label, please ask for approval from gregsheremeta. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment