fix: add gateway to ingress mode validation, validate required fields

[piotr-reducto]

Summary

Makes pgdog-control chart fully PSS Restricted compliant out of the box, with configurable securityContext via values so operators don't need to monkey-patch deployments.

Changes

1. Configurable securityContext via values (new)

Move hardcoded securityContext from deployment templates to values.yaml with PSS Restricted compliant defaults:

control:
  podSecurityContext:
    runAsNonRoot: true
    runAsUser: 1000
    runAsGroup: 1000
    seccompProfile:
      type: RuntimeDefault
  containerSecurityContext:
    allowPrivilegeEscalation: false
    capabilities:
      drop: ["ALL"]

redis:
  podSecurityContext:
    runAsNonRoot: true
    runAsUser: 999
    runAsGroup: 999
    fsGroup: 999
    seccompProfile:
      type: RuntimeDefault
  containerSecurityContext:
    allowPrivilegeEscalation: false
    readOnlyRootFilesystem: true
    capabilities:
      drop: ["ALL"]

Operators can override any field — e.g. control.podSecurityContext.runAsUser=65532 for clusters that prefer the nobody UID.

2. Gateway mode validation bug fix

ingress.yaml rejects ingress.mode: gateway (must be one of: aws, nginx, default) even though httproute.yaml renders for that mode. Add "gateway" to the allowed list and add required-field validation for gateway.name/gateway.namespace.

3. Version bump to 0.2.3

Test plan

• Default values render PSS Restricted compliant securityContext on both deployments
• Values override works (control.podSecurityContext.runAsUser=65532)
• Control pod starts and serves /healthz as uid=1000 (EKS staging-2)
• Control pod starts as uid=65532 (tested on EKS)
• ingress.mode=gateway with name/namespace — renders HTTPRoute
• ingress.mode=gateway without name — fails with clear error
• ingress.mode=invalid — fails with updated mode list
• ingress.mode=nginx — no regression

🤖 Generated with Claude Code