feat(common)!: security context to allow CIS compliance

[id710]

Solves mlflow-oidc/helm#11

Summary

Extend the common library chart with full pod-level and container-level
security context support, enabling dependent charts to meet the Kubernetes
Restricted Pod Security Standard and CIS Kubernetes Benchmark controls.

Motivation

Previously the common.security.context helper only rendered four pod-level
fields (runAsUser, runAsGroup, fsGroup, runAsNonRoot) and there was no
container-level security context anywhere in the rendering chain. It was
impossible to set seccompProfile at the pod level, or
allowPrivilegeEscalation, capabilities.drop, and readOnlyRootFilesystem at
the container level.

Changes

• Pod-level (common.security.context)

  • Added seccompProfile support (passed through via toYaml, so
    localhostProfile is supported too).
  • Existing defaults are unchanged (runAsUser: 1001, runAsGroup: 1001,
    fsGroup: 1001, runAsNonRoot: true).

• Container-level (common.security.containerContext)

  • New helper, rendered only when .Values.containerSecurityContext is
    set (opt-in, so existing deployments are not affected).
  • Each field cascades: container value → pod-level value → secure default.
    • allowPrivilegeEscalation defaults to false
    • readOnlyRootFilesystem defaults to true
    • runAsNonRoot / runAsUser fall back to the pod-level values
    • seccompProfile falls back to the pod-level value

• Bumped library version 2.3.0 → 2.4.0.

Example

securityContext:
  runAsUser: 1000
  runAsGroup: 1000
  fsGroup: 1000
  runAsNonRoot: true
  seccompProfile:
    type: RuntimeDefault

containerSecurityContext:
  allowPrivilegeEscalation: false
  readOnlyRootFilesystem: true
  runAsNonRoot: true
  runAsUser: 1000
  capabilities:
    drop:
      - ALL
  seccompProfile:
    type: RuntimeDefault