Harden pod and container security contexts across all workloads

Add securityContext hardening (runAsNonRoot, readOnlyRootFilesystem,
capabilities drop ALL, allowPrivilegeEscalation false) to the 10 workloads
that lacked it: apache-tika, cyberchef, gotenberg, homeassistant,
matrix-delegation-nginx, paperless-server, paperless-consume cronjob
(plus automountServiceAccountToken false), patchmon-frontend,
urlaubsverwaltung and zipline. All contexts are configurable via
securityContext.pod / securityContext.container in values.yaml; writable
paths are provided as emptyDirs. Image-forced deviations (Home Assistant
root start for s6-overlay + NET_RAW for discovery, paperless root init
container for /run ownership) are documented in the charts' values.yaml.
Major version bump for every changed published chart.

matrix-synapse/templates/matrix-delegation-nginx.configmap.yaml

@@ -6,15 +6,25 @@ metadata:
 data:
   nginx.conf: |
     worker_processes 1;
-  
+    # The container runs as the unprivileged nginx user with a read-only root
+    # filesystem: pid file and temp paths live in the /tmp emptyDir, and the
+    # listen port is unprivileged (8080).
+    pid /tmp/nginx.pid;
+
     events {
       worker_connections 1024;
     }
-    
+
     http {
+      client_body_temp_path /tmp/client_temp;
+      proxy_temp_path /tmp/proxy_temp;
+      fastcgi_temp_path /tmp/fastcgi_temp;
+      uwsgi_temp_path /tmp/uwsgi_temp;
+      scgi_temp_path /tmp/scgi_temp;
+
       server {
-        listen 80;
-        
+        listen 8080;
+
         location /.well-known/matrix/server {
           return 200 '{"m.server": "{{ .Values.ingress.domain }}:443"}';
           add_header Content-Type application/json;