chore(fix): Resolve Snyk IaC Findings for RHDH Helm Chart (with and without Orchestrator)

[Fortune-Ndlovu]

Description of the change

This PR addresses all reported Snyk Infrastructure-as-Code (IaC) findings for the RHDH Helm Chart in both configurations:

• Orchestrator disabled (backstage)
• Orchestrator enabled (backstage-orchestrator)
  https://app.snyk.io/org/developer-red-hat-developer-hub/projects

Validation

• snyk iac test shows 0 issues for both:
  • output/backstage
  • output/backstage-orchestrator
• Helm chart renders and deploys successfully in both configurations

Existing or Associated Issue(s)

https://issues.redhat.com/browse/RHIDP-7490

Additional Information

Checklist

• Chart version bumped in Chart.yaml according to semver.
• Variables are documented in the values.yaml and added to the README.md. The pre-commit utility can be used to generate the necessary content. Use pre-commit run -a to apply changes.
• JSON Schema template updated and re-generated the raw schema via pre-commit hook.
• List tests pass for Chart using the Chart Testing tool and the ct lint command.

[Fortune-Ndlovu]

/cc @rm3l

[rm3l]

@Fortune-Ndlovu Could you look into the CI failures reported? It looks like the DB container might fail to start: https://github.com/redhat-developer/rhdh-chart/actions/runs/15486926807/job/43603618835?pr=166#step:13:4901
Thanks.

[Fortune-Ndlovu]

@rm3l, the root cause was that we had enabled readOnlyRootFilesystem: true for the Bitnami PostgreSQL container to satisfy Snyk IaC best practices. However, the PostgreSQL image requires write access to internal paths like /var/lib/pgsql/passwd during startup.

This resulted in a CrashLoopBackOff and prevented Backstage from connecting to the DB, which in turn caused multiple plugins (like healthcheck) to fail initialization.

I have removed the readOnlyRootFilesystem setting specifically for PostgreSQL to allow it to boot successfully, while retaining it for the rest of the containers where it's safe and beneficial.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rm3l]

/lgtm