feat: Set a restricted security context on the operator Deployment

[lfrancke]

Description

Part of stackabletech/issues#645

The chart doesn't set either security context, so on a non-OpenShift K8s the operator Deployment runs without any. A namespace that enforces the restricted Pod Security Standard then refuses to create the Pod at all. I tested that on k3d with Kubernetes 1.33: without this change the Deployment stays at 0/1 with four violations, with it the operator comes up fine.

Nothing changes on OpenShift. The operator already lands on restricted-v2 there, which injects exactly these values which is also why I'm sure this'll not cause issues.

readOnlyRootFilesystem works for commons-operator too and I'd really like it but I'm afraid of missing some edge case where we do write something after all...

Once this is reviewed the same change follows for the other operators.
I believe secret-operator and listener-operator are excluded because they need root but maybe we can do something there, haven't checked yet.

Definition of Done Checklist

Author

• Changes are OpenShift compatible
• Helm chart can be installed and deployed operator works
• Integration tests passed (for non trivial changes)

Reviewer

• Code contains useful comments
• Changelog updated

Acceptance

• Proper release label has been added
• Release note snippet added