feat(security): enforce restricted security context defaults for all workloads

[aslafy-z]

What changed

Hardens the chart's default security posture so every workload the chart renders satisfies the Kubernetes restricted Pod Security Standard out of the box.

The restricted container security context applied by default everywhere:

readOnlyRootFilesystem: true
runAsNonRoot: true
allowPrivilegeEscalation: false
capabilities:
  drop:
    - ALL

Deployment

• deployment.containerSecurityContext (app container) now also sets allowPrivilegeEscalation: false and drops all capabilities.
• deployment.securityContext (pod level) defaults to seccompProfile.type: RuntimeDefault, inherited by all containers.
• Init containers and additionalContainers (map and list forms) inherit deployment.containerSecurityContext unless they define their own securityContext.
• New deployment.openshiftOAuthProxy.containerSecurityContext value applies the restricted context to the OAuth proxy sidecar, which previously rendered without any securityContext.

Jobs and CronJobs

• New chart-level defaults job.securityContext / cronJob.securityContext (pod level, runtime default seccomp profile) and job.containerSecurityContext / cronJob.containerSecurityContext (restricted container context) apply to every job.
• Per-job securityContext / containerSecurityContext values override the chart-level defaults, preserving the existing per-job API.
• Job and CronJob init containers inherit the container defaults unless they define their own securityContext.

values.schema.json and the README parameter table are regenerated accordingly.

Why

Closes #34. The chart already defaulted to runAsNonRoot: true and readOnlyRootFilesystem: true for the app container, but as noted in the issue discussion, permissions should also be dropped by default. Jobs, CronJobs, init containers, additional containers, and the OAuth proxy sidecar previously rendered with no security context at all.

User-visible effects

• Workloads relying on Linux capabilities, privilege escalation, a writable root filesystem, or a root user must now override the relevant default. An explicit securityContext / containerSecurityContext fully replaces the corresponding default block, so existing customizations are unaffected.
• Pod-level securityContext blocks are now always rendered. User-provided keys merge with the seccomp default per Helm value merging.
• The OAuth proxy sidecar is OpenShift-only; its images carry no USER, so runAsNonRoot: true relies on the SCC-injected UID, which is standard on OpenShift.

Validation

• helm unittest: 403 tests pass, including new tests covering the restricted defaults and per-container overrides for the deployment (app, init, additional, and OAuth proxy containers), Jobs, and CronJobs.
• helm lint passes.