[Feature Request]: support enable python UDF server sidecar

[aylei]

Is there an existing issue for the same feature request?

• [X] I have checked the existing issues.

Is your feature request related to a problem?

https://github.com/matrixorigin/matrixone/pull/11098 introduced python UDF support for MO, which requires a sandboxed python container that runs beside the MO process to handle python UDFs.

Describe the feature you'd like

Add an option in CNSetSpec to enable UDF support:

kind: CNSet
spec:
  udfSidecar:
     enabled: true # *bool, optional, default to false 
     image: my-awesome-image # *string, optional, default value to be decided
     resources: {} # optional, default to nil (best-effort)
     overlay: {} # optional, default to nil, see the Overlay struct

A minimum YAML to enable UDF support, there should be no additional fields required:

kind: CNSet
spec:
  udfSidecar:
    enabled: true
  otherFieldsThatDoesNotRelevantToUDF: ...

If UDF sidecar is enabled, the operator should create CN pods or upgrade existing CN pods to run a UDF sidecar and configure the CN process to use the UDF service hosted by the sidecar container.

Note, the securityContext of sidecar should be carefully designed, only required capabilities should be enabled and all other capabilities should be disabled in favor of security.

ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/

Describe implementation you've considered

No response

Documentation, Adoption, Use Case, Migration Strategy

No response

Additional information

No response