Don't render fsGroup unless explicitly required

[lgadban]

Describe the bug
The following deployments are broken by default when installing on a fresh OCP cluster (i.e. no SCCs):

discovery
gateway-proxy
redis

This is because they are rendering out a securityContext that contains an fsGroup that can not be disabled.

To Reproduce
helm installation on an OCP cluster with the following values:

global:
  extensions:
    extAuth:
      deployment:
        floatingUserId: true
    rateLimit:
      deployment:
        floatingUserId: true
redis:
  deployment:
    floatingUserId: true
gloo:
  gloo:
    deployment:
      floatingUserId: true
  discovery:
    deployment:
      floatingUserId: true
  gateway:
    deployment:
      floatingUserId: true
    certGenJob:
      floatingUserId: true
  gatewayProxies:
    gatewayProxy:
      podTemplate:
        floatingUserId: true
        disableNetBind: true
        runUnprivileged: true
prometheus:
  enabled: false
grafana:
  defaultInstallationEnabled: false

Expected behavior
All deployments to spin up correctly

Additional context
OCP4

Server: {"type":"Gateway","enterprise":true,"kubernetes":{"containers":[{"Tag":"1.7.6","Name":"discovery","Registry":"quay.io/solo-io"},{"Tag":"1.7.7","Name":"extauth-ee","Registry":"quay.io/solo-io"},{"Tag":"1.7.6","Name":"gateway","Registry":"quay.io/solo-io"},{"Tag":"1.7.7","Name":"gloo-ee-envoy-wrapper","Registry":"quay.io/solo-io"},{"Tag":"1.7.7","Name":"gloo-ee","Registry":"quay.io/solo-io"},{"Tag":"1.7.7","Name":"rate-limit-ee","Registry":"quay.io/solo-io"},{"Tag":"5","Name":"redis","Registry":"docker.io"}],"namespace":"gloo-system"}}