[un-def]

The jump pod requested no resources, so it was BestEffort, the first pod the kubelet evicts under node pressure. Since #4447, its ReplicaSet recreates it, but every eviction still drops all SSH sessions through the jump pod.

• The jump pod container now requests and limits CPU and memory equally, which gives it the Guaranteed QoS class. The defaults, 500m and 1Gi, come from measuring the jump pod image: ~9 MiB plus ~1.6 MiB per tunneled SSH session, and 130-180 MiB/s of tunneled traffic at 500m.
• The new proxy_jump.cpu and proxy_jump.memory properties override the defaults. Values must be Kubernetes quantities of at least 100m and 32Mi.
• The container also requests 64Mi of ephemeral storage, without a limit. QoS doesn't cover disk pressure, under which the kubelet first evicts pods whose disk usage exceeds their ephemeral-storage request.
• A jump pod that can't be scheduled, e.g., due to insufficient resources, is now logged as a warning with the scheduler's reason. Before, the only symptom was runs hitting the provisioning timeout.

Notes:

• New values don't apply to an existing jump pod. The docs describe how to apply them with kubectl.
• A legacy jump pod that the ReplicaSet adopts on upgrade stays BestEffort until it's recreated.

Fixes: #4407