Set container securityContext by default

[consideRatio]

This can help us avoid usage of root by default which can cause clusters with PodSecurityPolicy resources to stop the Helm chart from functioning.

In practice, what I do in this PR is to create Helm chart configuration to set all Pod's containers' securityContext, and let this configuration default to have a securityContext like this be injected to all of our managed containers within the pods.

# some of our k8s Deployment resources
spec:
  template:
    spec:
      containers:
        - image: ...
          # ...
          securityContext:
            runAsUser: 65534
            runAsGroup: 65534
            allowPrivilegeEscalation: false

A securityContext of a pod with a runAsUser directive will force the container to startup as that user instead of the default: root. This can add another layer of security to by letting the containers we run not end up escalating privileges and ending up abusing some k8s vulnerability to do harmful stuff.

Fixes #1386, but not #1408.

singleuser.containerSecurityContext ?

This PR does not add singleuser.containerSecurityContext, yet, because it is quite a bit more complicated at the moment. KubeSpawner expose some configuration that in the end goes into either the pod's securityContext or the container's securityContext. Here is an overview.

KubeSpawner.*	PodSecurityContex	SecurityContext
fs_gid	fsGroup	-
supplemental_gids	supplementalGroups	-
run_as_uid	-	runAsUser
run_as_gid	-	runAsGroup
privileged	-	privileged

Breaking change

• proxy.containerSecurityContex has been renamed to proxy.chp.containerSecurityContex

---

I deem that this can be said to close #937 good enough, but only properly by setting singleuser.cloudMetadata.blockWithIptables: false.

Closes #1491, Closes #1677

[yuvipanda]

I like! Disabling privilege escalation is my fav!

[yuvipanda]

@consideRatio This LGTM! Happy to merge once the conflict is resolved. <3 for better security by default!

[consideRatio]

@yuvipanda merge conflicts resolved!

[yuvipanda]

Thanks, @consideRatio!

[consideRatio]

Wieee thank you for taking the time to review this @yuvipanda !