fix: skip projects init-container under restricted_security_context (#14)

The init-projects container chmod/chgrp's /var/lib/awx/projects. With
restricted_security_context enabled it inherits the pod's runAsNonRoot (uid
1000) yet still runs chmod/chgrp, which a non-root process without CAP_FOWNER
cannot do on a volume it does not own. The container exits "Operation not
permitted" and the web/task pods never start.

Under restricted_security_context the pod already sets fsGroup, which the
kubelet applies to fsGroup-capable volumes (the same mechanism the option
relies on for the backup pod). So skip the privileged init-projects container
in that mode and rely on fsGroup, rather than shipping a chown that can only
fail. Non-restricted behavior is unchanged.

Note: fsGroup is not applied to NFS-backed RWX volumes, so such a volume must
present a directory writable by the projects gid (many RWX provisioners create
the share root world-writable).

Author: Aureliolo

roles/installer/templates/deployments/task.yaml.j2

@@ -194,18 +194,11 @@ spec:
 {% if init_container_extra_volume_mounts -%}
             {{ init_container_extra_volume_mounts | indent(width=12, first=True) }}
 {% endif %}
-{% if projects_persistence|bool and is_k8s|bool %}
+{% if projects_persistence|bool and is_k8s|bool and not (restricted_security_context | bool) %}
         - name: init-projects
           image: '{{ _init_projects_container_image }}'
           imagePullPolicy: '{{ image_pull_policy }}'
           resources: {{ init_container_resource_requirements }}
-{% if restricted_security_context | bool %}
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-                - ALL
-{% endif %}
           command:
             - /bin/sh
             - -c

roles/installer/templates/deployments/web.yaml.j2

@@ -138,18 +138,11 @@ spec:
             {{ init_container_extra_volume_mounts | indent(width=12, first=True) }}
 {% endif %}
 {% endif %}
-{% if projects_persistence|bool and is_k8s|bool %}
+{% if projects_persistence|bool and is_k8s|bool and not (restricted_security_context | bool) %}
         - name: init-projects
           image: '{{ _init_projects_container_image }}'
           imagePullPolicy: '{{ image_pull_policy }}'
           resources: {{ init_container_resource_requirements }}
-{% if restricted_security_context | bool %}
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-                - ALL
-{% endif %}
           command:
             - /bin/sh
             - -c