feat: Update manifests to match upstream kfp 2.16.0 release

[mvlassis]

Ref: #869

This PR updates the charms according to the update to the manifests files corresponding to the 2.16.0 release of Kubeflow pipelines. This task is part of the team's upgrade to Kubeflow 26.03.

The diff between the 2 versions was generated by following the instructions on the upstream README. It can be found here.

Notes

• Update kfp rocks to the newer upstream versions.
• Replace envoy rock with ghcr.io/kubeflow/kfp-metadata-envoy:2.16.0, since it is now using v1.37.0. See feat: Update manifests to match upstream kfp 2.16.0 release envoy-operator#203.
• Update deployment for mlmd, see feat: Update manifests to match upstream kfp 2.16.0 release mlmd-operator#173.
• A lot of deployments were updated to set a seccompProfile, which is a security setting for limiting syscalls within the containers. For more details, see the Kubernetes documentation. Unfortunately, this is not possible to use when using Juju for deploying the workloads.
• In a similar manner, we cannot specifically drop all Linux capabilities, which is not used in the workflow-controller-configmap configMap.
• In parallel, some deployments added a runAsNonRoot: true key-value pair, which we already implement in our charms by setting the uid and gid to a non-root value in the charmcraft.yaml files.
• kfp-schedwf has introduced metrics in Recurring Runs Queue Throughput Optimization kubeflow/pipelines#12610. I have created Add metrics to kfp-schedwf #871 to track the respective effort in CKF.
• The addition of the kubeflow_pipelines_version value in a new configMap seems redundant, as it is only used in the repository for denoting new versions, and never in the actual code. See the Pipelines README.
• A few changes (e.g. adding OBJECT_STORE_HOST, CLUSTER_DOMAIN, changes to sync.py) correspond to the change from minio to using seaweedfs with separate user buckets. We do not include those changes here, the changes are tracked in Update logic in sync.py to match the effort in upstream #822
• Remove comments for updating the user when changing the OCI from upstream to a rock and vice-versa. This is because we don't anymore use a service-config.yaml.

[mvlassis]

After discussing with @misohu, we:

• Try to create the same bucket that apiserver needs, in order to avoid creating unnecessary buckets.
• Defer the event in case the object storage is not reachable. This follows the good practices for deferring an event, since the error should only be temporary (during startup of minio). We prefer not to defer on reconciler patterns, so we just wait until the next event is triggered to put the status to "active".

[misohu]

Wait we never defer in our charms we use update status

[NohaIhab]

Thanks @mvlassis, some comments and questions for me to understand