feat: configure gitaly with recommended resiliency settings

[JoeHCQ1]

Added a Pepr policy exemption to enable cgroups, added cgroups variable, added other recommended settings from https://docs.gitlab.com/ee/administration/gitaly/kubernetes.html

Problems:

1. The exemptions are there regardless of whether or not we wanted to use cgroup policing. Alternative: add a helm chart where I can dynamically add or not add the manifest based on the desired-ness of cgroups.
2. The cgroups are very your-environment specific. This needs messaged clearly as there's no out-of-the-box solution here.
3. That this feature weakens security should probably be clearly communicated as a tradeoff.

Note, the only "testing" I forsee being possible in this setup is verifying that the settings took. Fail behavior would require overwhelming our massive gitaly node.

[jacobbmay]

1. The exemption being present whether the cgroups setting is used or not is fine. The expectation is that the cgroups settings are configured because they are recommended by GitLab for stability.
2. This is true, however we should also set defaults that correspond to whatever the default resource settings are for Gitaly. Just need to document the need to modify them if Gitaly resource allocations are changed.
3. I don't think this is necessary as I would consider it an essential feature for production ready Gitaly in kubernetes. No different than any of the other exemptions that we already have in place even if this is technically an optional setting.

[JoeHCQ1]

@bburky this is where we're giving Gitaly the keys to the kingdom.

[jacobbmay]

LGTM