Make operator security contexts configurable and restricted Pod Security compliant

[alexandergott-afk]

Summary

This PR makes the MySQL Operator Helm chart compatible with namespaces enforcing the Kubernetes restricted Pod Security Standard.
The operator Deployment previously hardcoded both pod-level and container-level securityContext values, but did not set seccompProfile.type. This causes pod creation to fail in namespaces labeled with:

pod-security.kubernetes.io/enforce=restricted

The Kubernetes restricted profile requires workloads to use an allowed seccomp profile such as RuntimeDefault or Localhost, and also requires settings such as non-root execution, disabled privilege escalation, and dropped capabilities. [kubernetes.io]
This change adds configurable Helm values for:

• podSecurityContext
• containerSecurityContext

and sets secure defaults including:

seccompProfile:
  type: RuntimeDefaultWeitere Zeilen anzeigen

Problem

When installing the chart into a namespace enforcing the restricted Pod Security Standard, the operator pod is rejected with an error similar to:

Error creating: pods "mysql-operator-..." is forbidden:
violates PodSecurity "restricted:latest":
seccompProfile (pod or container "mysql-operator" must setsecurityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")

The chart currently hardcodes security contexts in the Deployment template:

securityContext:
  runAsNonRoot: true

and:

securityContext:
  capabilities:
    drop:
      - ALL
  runAsUser: 2
  allowPrivilegeEscalation: false
  privileged: false
  readOnlyRootFilesystem: true
  runAsNonRoot: true

However, seccompProfile.type is missing.
Additionally, because these security contexts are not exposed through values.yaml, users cannot fix the issue through Helm values.

Solution

This PR:

Adds podSecurityContext to values.yaml
Adds containerSecurityContext to values.yaml
Uses these values in the Deployment template
Sets seccompProfile.type: RuntimeDefault by default

This keeps the chart secure by default while allowing users to override security context settings through Helm.

[mysql-oca-bot]

Hi, thank you for submitting this pull request. In order to consider your code we need you to sign the Oracle Contribution Agreement (OCA). Please review the details and follow the instructions at https://oca.opensource.oracle.com/
Please make sure to include your MySQL bug system user (email) in the returned form.
Thanks