Add --exclude-resources flag for skipping resource types during collection

[bshaw7]

What this PR does / why we need it

Adds an --exclude-resources flag that allows users to specify resource types to skip during cluster resource collection.

Currently, sonobuoy skips only secrets by default (#1539). Different Kubernetes distributions embed sensitive data in platform-specific custom resources — for example, OpenShift's MachineConfig and ControllerConfig embed pull secrets and JWTs in ignition configs. There is no way for users to exclude these resource types without modifying sonobuoy code.

This PR adds a simple exclusion filter that keeps the decision with the user, requiring no content awareness from sonobuoy.

Example usage

sonobuoy run --exclude-resources MachineConfig,ControllerConfig,PackageManifest

Or via config file:

sonobuoy gen config | jq '.ExcludeResources = ["MachineConfig","ControllerConfig"]' > config.json
sonobuoy run --config config.json

Which issue(s) this PR fixes

Fixes #2056

Changes

File	Change
pkg/config/config.go	Add ExcludeResources []string field to Config struct
pkg/discovery/query.go	Add exclusion check in filterResources(), update callers
cmd/sonobuoy/app/args.go	Add --exclude-resources CLI flag
cmd/sonobuoy/app/gen.go	Wire flag to config in GenFlagSet()
pkg/discovery/query_test.go	Add 4 test cases for exclude filtering

Special notes for reviewers

• Backward compatible: nil ExcludeResources = exclude nothing (default behavior unchanged)
• Follows the existing pattern of Resources (include list) — this adds the inverse (exclude list)
• Exclusion is applied after the implicit secrets skip, so secrets are still skipped by default regardless of ExcludeResources
• Uses existing sliceContains() helper for the check

Release note

Add --exclude-resources flag to allow skipping specific resource types during cluster resource collection

[bshaw7]

Local Verification

$ make test 2>&1 | tail -5
ok  github.com/vmware-tanzu/sonobuoy/pkg/tarball       5.519s
ok  github.com/vmware-tanzu/sonobuoy/pkg/worker        55.339s
PASS

$ go test ./pkg/discovery/ -run TestFilterResources -v 2>&1 | grep -E 'RUN|PASS'
=== RUN   TestFilterResources
=== RUN   TestFilterResources/Bad_filter_will_lead_to_no_resources
=== RUN   TestFilterResources/Specific_filter_will_grab_one_item_(namespaced)
=== RUN   TestFilterResources/Filter_one_item_(non-namespaced)
=== RUN   TestFilterResources/Filters_out_namespaced_values
=== RUN   TestFilterResources/Filters_non-namespaced_values
=== RUN   TestFilterResources/Empty_namespace_gets_non-namespaced_values
=== RUN   TestFilterResources/Filters_listable
=== RUN   TestFilterResources/Filters_secrets_when_querying_everything_implicitly
=== RUN   TestFilterResources/Can_get_secrets_explicitly
=== RUN   TestFilterResources/Excludes_resources_in_ExcludeResources_list
=== RUN   TestFilterResources/ExcludeResources_with_nil_list_excludes_nothing
=== RUN   TestFilterResources/ExcludeResources_does_not_affect_resources_not_in_list
=== RUN   TestFilterResources/ExcludeResources_works_when_querying_everything_implicitly
--- PASS: TestFilterResources (0.00s)

$ go build ./...
(exit code: 0)

$ sonobuoy run --help | grep exclude
      --exclude-resources strings   Resources to exclude from collection (e.g. MachineConfig,PackageManifest). Applied after the implicit secrets filter.

$ sonobuoy gen --help | grep exclude
      --exclude-resources strings   Resources to exclude from collection (e.g. MachineConfig,PackageManifest). Applied after the implicit secrets filter.

All existing tests pass, 4 new test cases pass, build succeeds, flag registered on both run and gen commands.