feat(helm): improve restricted security context support

[attilaolah]

Please provide a way to apply restrictive security contexts consistently to all chart-managed pods and containers, including init jobs and built-in init containers.

Ideally, the chart could ship restricted-compatible defaults out of the box:

• runAsNonRoot: true
• allowPrivilegeEscalation: false
• capabilities.drop: ["ALL"]
• seccompProfile.type: RuntimeDefault
• non-root UID/GID where supported by the image

At minimum, please add values that let users set default pod/container security contexts for every workload and every built-in init container without replacing upstream init container definitions. This would make the chart easier to run in namespaces enforcing Kubernetes restricted Pod Security.

[rusackas]

Converted this to an Ideas thread since it's a feature request rather than a bug. You might want to see if the https://apache.github.io/superset-kubernetes-operator/ we're moving to in favor of helm addresses your need, and if not, file an issue there and/or ping @villebro here.