fix: make securityContext configurable to resolve OpenShift non-default namespace deployment failure

[narayviv]

The COSI provisioner pod fails to deploy in non-default namespaces on OpenShift
clusters (AS-222433) because the deployment template hardcodes runAsUser: 1000,
runAsGroup: 1000, and fsGroup: 2000. These values conflict with OpenShift's
namespace-assigned UID/GID ranges enforced by the restricted-v2 SCC.

Changes:

• Remove hardcoded UID/GID from pod securityContext in deployment template
• Add configurable podSecurityContext (defaults to runAsNonRoot: true only)
• Add configurable containerSecurityContext with restricted-profile defaults
  (allowPrivilegeEscalation: false, drop ALL capabilities, RuntimeDefault seccomp)
• Update values.schema.json with new field definitions

This makes the chart compatible with both OpenShift (restricted-v2 SCC) and
Kubernetes (restricted Pod Security Standard) without requiring manual SCC
grants like anyuid.

[datamattsson]

If this runs on Kubernetes and OpenShift without modification, all these changes doesn't need to be parameterized. When would a user need to change any of these?