Kubernetes 1.37 finally locks down volumes with noexec, nosuid, and an emptyDir mode

Kubernetes v1.37 introduces two storage security settings, still in alpha: bind mount options (noexec, nosuid, nodev) and a permission mode on emptyDir volumes. Enable the VolumeBindMountOptions and EmptyDirVolumeMode feature gates to replace init-container workarounds.