Support excluding specific resource types from cluster resource collection

[bshaw7]

When sonobuoy collects cluster resources, it dumps all resource types including those that may contain embedded sensitive data (e.g., MachineConfig with pull secrets, ControllerConfig with registry auth, PackageManifests with private keys).

Currently, sonobuoy deliberately skips Secret resources (#1539), but there's no way for users to exclude other resource types that embed sensitive data in platform-specific fields.

Proposal: Add an --exclude-resources flag (or config option) that allows users to specify resource types to skip during collection.

Example:

sonobuoy run --exclude-resources MachineConfig,ControllerConfig,PackageManifest

Or in the sonobuoy config:

resources:
  exclude:
    - MachineConfig
    - ControllerConfig
    - PackageManifest

Why:

• Different Kubernetes distributions embed sensitive data in different custom resources — there's no universal list
• Platform teams (OpenShift, Tanzu, Rancher) know which resource types contain sensitive data in their distributions
• This keeps the decision with the user, not with sonobuoy — no scanning or content awareness needed
• Simple filter on the resource type before collection

Use case:
When running sonobuoy for conformance validation on distributions like OpenShift, the collected archives are uploaded to cloud storage where security scanning tools flag sensitive data embedded in platform-specific resources like MachineConfig and PackageManifests. Currently the only workaround is post-processing archives to remove these files — an exclude flag would prevent collecting them in the first place.

Related: #1539

[bshaw7]

Opened a PR implementing this: #2059

Adds --exclude-resources flag and ExcludeResources config field. Usage:

sonobuoy run --exclude-resources MachineConfig,ControllerConfig,PackageManifest

All existing tests pass + 4 new test cases for the exclude filtering.