Harden pod and container security contexts across all workloads

Add securityContext hardening (runAsNonRoot, readOnlyRootFilesystem,
capabilities drop ALL, allowPrivilegeEscalation false) to the 10 workloads
that lacked it: apache-tika, cyberchef, gotenberg, homeassistant,
matrix-delegation-nginx, paperless-server, paperless-consume cronjob
(plus automountServiceAccountToken false), patchmon-frontend,
urlaubsverwaltung and zipline. All contexts are configurable via
securityContext.pod / securityContext.container in values.yaml; writable
paths are provided as emptyDirs. Image-forced deviations (Home Assistant
root start for s6-overlay + NET_RAW for discovery, paperless root init
container for /run ownership) are documented in the charts' values.yaml.
Major version bump for every changed published chart.

paperless-ngx/templates/paperless-consume.cronjob.yaml

@@ -9,10 +9,15 @@ spec:
     spec:
       template:
         spec:
+          automountServiceAccountToken: false
+          securityContext:
+            {{- toYaml .Values.smbConnection.cron.securityContext.pod | nindent 12 }}
           containers:
             - name: paperless-consume-cronjob
               image: busybox:1.28
               imagePullPolicy: IfNotPresent
+              securityContext:
+                {{- toYaml .Values.smbConnection.cron.securityContext.container | nindent 16 }}
               command:
                 - /bin/sh
                 - -c