[release/v1.9] kata: don't add storage for implicit VOLUME mounts

[burgerdev]

• e2e regression TDX
• e2e regression SNP executed manually

[burgerdev]

Imho we can ignore the govulncheck findings:

Vulnerability #1: GO-2025-3751
Sensitive headers not cleared on cross-origin redirect in net/http
More info: https://pkg.go.dev/vuln/GO-2025-3751
Standard library
Found in: net/[email protected]
Fixed in: net/[email protected]
Example traces found:
#1: nodeinstaller/internal/asset/http.go:100:30: asset.HTTPFetcher.FetchUnchecked calls http.Client.Do

Nodeinstaller is not setting sensitive headers.

Vulnerability #2: GO-2025-3750
Inconsistent handling of O_CREATE|O_EXCL on Unix and Windows in os in
syscall
More info: https://pkg.go.dev/vuln/GO-2025-3750

Windows is not a supported target, behaviour on UNIX is ok before and after.

Vulnerability #3: GO-2025-3749
Usage of ExtKeyUsageAny disables policy validation in crypto/x509
More info: https://pkg.go.dev/vuln/GO-2025-3749
Standard library
Found in: crypto/[email protected]
Fixed in: crypto/[email protected]
Example traces found:
#1: internal/attestation/snp/validator.go:100:40: snp.Validator.Validate calls verify.SnpAttestationContext, which eventually calls x509.Certificate.Verify

As far as I know, we don't have policy graphs in certificates relevant to attestation.