feat: add securityContext defaults to deployment manifest

[tjespers]

Fix ?

In it's current form, the installation instructions for capacitor in this repository do not work for clusters that are hardened following pod security best practices and have the restricted pod security standard enforced for it's flux-system namespace.

The following error will be thrown by the kubernetes API:

'pods "capacitor-XXXXX-XXXX" is forbidden: violates PodSecurity "restricted:latest":
      allowPrivilegeEscalation != false (container "capacitor" must set securityContext.allowPrivilegeEscalation=false),
      unrestricted capabilities (container "capacitor" must set securityContext.capabilities.drop=["ALL"]),
      runAsNonRoot != true (pod or container "capacitor" must set securityContext.runAsNonRoot=true),
      seccompProfile (pod or container "capacitor" must set securityContext.seccompProfile.type
      to "RuntimeDefault" or "Localhost")'

Solution

In a similar fashion to flux's security documentation this change makes the capacitor manifests compatible with the standard allowing deployment to a hardened cluster without manual configuration by the enduser.

What has been done

• The helm values have been updated to include a securityContext compatible with the "restricted" PodSecurity standard profile
• The manifests have been re-rendered to include this change

[laszlocph]

This is a quality pull request. Sorry for keeping you waiting.