Bump coreos-kube-state-metrics version

To make monitoring work when hardening rules are applied.

Problem:
Fails to run nginx proxies, because user home directory is not owned by nginx user inside newer nginx-alpine images

Solution:
Mount emptyDir to the user home directory(/var/cache/nginx) so that it
is writable by the nginx user.
Also update UID from 100 to 101 to be consistent with upstream changes(https://github.com/nginxinc/docker-nginx/issues/218)

logging 0.1.2 -> 0.1.3
monitoring 0.0.4 -> 0.0.5

Copy the binary to the host before wins cli prc run

Add PSP and related role/rolebinding/SA resources to logging chart.
The PSP contains restricted rules + hostPath volume.
Also, remove unnecessary privileged escalation from log-aggregator.

**Problem:**
Could not distinguish Windows images from `values.yaml`

**Solution:**
- Add a new field `os` below field `image`
- Must indicate `os: windows` if the image is using in Windows cluster

https://github.com/rancher/rancher/issues/22788

Problem:
windows will throws error when the file already exist, which is different from linux

Solution:
change to use new-item

Issue:
https://github.com/rancher/rancher/issues/22679

- Bump Prometheus operator image version
- Sync upstream CRDs. Add PodMonitor and update the rest.(https://github.com/helm/charts/tree/master/stable/prometheus-operator/templates/prometheus-operator)
- Update ClusterRole

Related Upstream changes:
https://github.com/helm/charts/commit/6a94c082c2daf8be72ac241397d652993ad82a0b#diff-b9f481ac97524bfb24d27f62676dc143
https://github.com/helm/charts/commit/d58247103fafd5930792bb1fd3ac240547523200#diff-23b6255dfa711af76ad99181e2fb0464

Note:
See https://kubernetes.io/blog/2019/07/18/api-deprecations-in-1-16/
- PSP is introduced in policy apigroup in 1.10, and removed from extensions apigroup in 1.16.
- DaemonSet, Deployment, StatefulSet, and ReplicaSet migrate to apps in 1.9, and no longer be served from extensions in 1.16
- Ingress is migrated to networking.k8s.io in 1.14, and will be removed from extensions in 1.18

Changes:
1. fluentd: add sub charts fluentd-linux and fluentd-:windows
2. log-aggregator: remove useless service account
3. log-aggregator: add sub charts log-aggregator-linux and
log-aggregator-windows

Problem:
Fail to enable monitoring on restricted PSP clusters.

Solution:
1. Update grafana to run as grafana user.
2. Update nginx sidecars to run as nginx user, move files to the user
home directory(/var/cache/nginx) and listen on non privileged 8080 port.
With 1 & 2, project monitoring works in restricted clusters out of the
box.
3. Add necessary PSP/role/rb resource to node-exporter, which is used by
cluster monitoring.