Add conformance test to validate runAsUser is as specified

[dgerd]

In what area(s)?

/area API
/area test-and-release

Describe the feature

This issue is to add a conformance test that validates the MUST, SHOULD, and SHALL statements of the user section ( https://github.com/knative/serving/blob/master/docs/runtime-contract.md#user ) in the runtime contract.

The test should validate that:

• When passing a valid runAsUser the container runs with that user.
• When passing an invalid runAsUser the container fails

[dgerd]

/assign @dgerd

[dgerd]

We do not seem to set a platform-specific default as called out in the runtime contract. We instead seem to implement the Kubernetes behavior which to "Default to user specified in image metadata if unspecified."

https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.10/#container-v1-core

[dgerd]

We also currently accept negative runAs user values as well as values greater than an int32 which are invalid. Need to add validation to the webhook and a test.

[dgerd]

Need to answer:

• How should platform providers and operators ban certain UIDs?
• How should we validate UID until we can perform kubernetes dryruns?
• Should we allow a platform default or update language? If we update langauge how do we easily ban UIDs?

[mattmoor]

/milestone Serving 0.6
We'll have the basic test in 0.5, but the open questions above will likely overshoot.