feat(chart): expose podSecurityContext and securityContext values

[vishwakt]

What

Closes #1253.

Adds podSecurityContext (pod-level) and securityContext (container-level) values to the Helm chart and wires them into both the Deployment and DaemonSet templates (chart/templates/deployment.yaml, chart/templates/daemonset.yaml).

Secure defaults are shipped, as proposed in the issue, so the controller no longer runs as root with a writable root filesystem out of the box:

podSecurityContext:
  runAsNonRoot: true
  runAsUser: 65532
  seccompProfile:
    type: RuntimeDefault
securityContext:            # container-level
  readOnlyRootFilesystem: true
  allowPrivilegeEscalation: false
  capabilities:
    drop: ["ALL"]

Why

This satisfies the Pod Security restricted profile and common lint gates (kube-linter run-as-non-root / no-read-only-root-fs), removing the need for repo-wide lint waivers or post-render kustomize patches on hardened clusters.

Notes

• readOnlyRootFilesystem: true is safe: the runtime controller does not write to its root filesystem (the only filesystem writes in the repo are in tools/ and internal/testsupport/, neither of which is in the runtime path). No writable emptyDir is needed.
• The image runs as root (no USER in the Dockerfile), so runAsNonRoot is correctly paired with an explicit runAsUser: 65532.
• Both blocks are {{- with }}-guarded, so operators can relax or disable them by overriding the values (e.g. set to {}).
• This changes behavior on upgrade for existing installs (they flip to non-root + read-only root fs). Flagging for release-note visibility.
• Regenerated chart snapshots (chart/.snapshots/*.yaml) and deploy manifests (deploy/ccm.yaml, deploy/ccm-networks.yaml); helm lint passes.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 67.93%. Comparing base (6656e34) to head (9f37319).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1258      +/-   ##
==========================================
- Coverage   70.38%   67.93%   -2.45%     
==========================================
  Files          26       26              
  Lines        2776     2776              
==========================================
- Hits         1954     1886      -68     
- Misses        647      720      +73     
+ Partials      175      170       -5     

Flag	Coverage Δ
e2e	?
unit	67.93% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[lukasmetzner]

Looking good. Thanks for the contribution 😊