Harden pod and container security contexts across all workloads

Add securityContext hardening (runAsNonRoot, readOnlyRootFilesystem,
capabilities drop ALL, allowPrivilegeEscalation false) to the 10 workloads
that lacked it: apache-tika, cyberchef, gotenberg, homeassistant,
matrix-delegation-nginx, paperless-server, paperless-consume cronjob
(plus automountServiceAccountToken false), patchmon-frontend,
urlaubsverwaltung and zipline. All contexts are configurable via
securityContext.pod / securityContext.container in values.yaml; writable
paths are provided as emptyDirs. Image-forced deviations (Home Assistant
root start for s6-overlay + NET_RAW for discovery, paperless root init
container for /run ownership) are documented in the charts' values.yaml.
Major version bump for every changed published chart.

matrix-synapse/values.yaml

@@ -5,6 +5,21 @@ matrix:
   delegation:
     enabled: false
     serverUrl: null
+    # The delegation nginx runs as the image's unprivileged nginx user
+    # (uid 101) and listens on the unprivileged port 8080; pid file and temp
+    # paths are redirected to the /tmp emptyDir by the mounted nginx.conf.
+    securityContext:
+      pod:
+        runAsNonRoot: true
+        runAsUser: 101
+        runAsGroup: 101
+      container:
+        allowPrivilegeEscalation: false
+        readOnlyRootFilesystem: true
+        runAsNonRoot: true
+        capabilities:
+          drop:
+            - ALL
     resources:
       limits:
         memory: "128Mi"