kubernetes: replace the deprecated AppArmor annotation

Use the container AppArmor profile for rootless builders and remove conflicting legacy annotations.
Document the Kubernetes version requirement and cover both workload types.

Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>