Harden pod and container security contexts across all workloads

Add securityContext hardening (runAsNonRoot, readOnlyRootFilesystem,
capabilities drop ALL, allowPrivilegeEscalation false) to the 10 workloads
that lacked it: apache-tika, cyberchef, gotenberg, homeassistant,
matrix-delegation-nginx, paperless-server, paperless-consume cronjob
(plus automountServiceAccountToken false), patchmon-frontend,
urlaubsverwaltung and zipline. All contexts are configurable via
securityContext.pod / securityContext.container in values.yaml; writable
paths are provided as emptyDirs. Image-forced deviations (Home Assistant
root start for s6-overlay + NET_RAW for discovery, paperless root init
container for /run ownership) are documented in the charts' values.yaml.
Major version bump for every changed published chart.

patchmon/templates/patchmon-frontend.deployment.yaml

@@ -16,10 +16,14 @@ spec:
         app: {{ .Release.Name }}-{{ .Chart.Name }}-frontend
     spec:
       automountServiceAccountToken: false
+      securityContext:
+        {{- toYaml .Values.patchmon.frontend.securityContext.pod | nindent 8 }}
       containers:
         - name: {{ .Release.Name }}-{{ .Chart.Name }}-frontend
           image: "ghcr.io/patchmon/patchmon-frontend:{{ .Chart.AppVersion }}"
           imagePullPolicy: IfNotPresent
+          securityContext:
+            {{- toYaml .Values.patchmon.frontend.securityContext.container | nindent 12 }}
           ports:
             - containerPort: 3000
               protocol: TCP
@@ -59,8 +63,19 @@ spec:
             - name: patchmon-volume
               mountPath: /usr/share/nginx/html/assets
               subPath: patchmon-assets
+            # nginx-unprivileged keeps its pid file and temp dirs in /tmp, and
+            # its entrypoint renders config templates into /etc/nginx/conf.d;
+            # both must be writable with a read-only root filesystem.
+            - name: tmp
+              mountPath: /tmp
+            - name: nginx-conf-d
+              mountPath: /etc/nginx/conf.d
       restartPolicy: Always
       volumes:
+        - name: tmp
+          emptyDir: {}
+        - name: nginx-conf-d
+          emptyDir: {}
         - name: patchmon-volume
           persistentVolumeClaim:
             claimName: {{ .Release.Name }}-{{ .Chart.Name }}-pvc