Harden pod and container security contexts across all workloads

Add securityContext hardening (runAsNonRoot, readOnlyRootFilesystem,
capabilities drop ALL, allowPrivilegeEscalation false) to the 10 workloads
that lacked it: apache-tika, cyberchef, gotenberg, homeassistant,
matrix-delegation-nginx, paperless-server, paperless-consume cronjob
(plus automountServiceAccountToken false), patchmon-frontend,
urlaubsverwaltung and zipline. All contexts are configurable via
securityContext.pod / securityContext.container in values.yaml; writable
paths are provided as emptyDirs. Image-forced deviations (Home Assistant
root start for s6-overlay + NET_RAW for discovery, paperless root init
container for /run ownership) are documented in the charts' values.yaml.
Major version bump for every changed published chart.

patchmon/values.yaml

@@ -3,6 +3,24 @@ patchmon:
     size: 10Gi
     storageClass: null
   frontend:
+    # The frontend image is based on nginx-unprivileged; the pod runs as its
+    # nginx user (uid 101). The image's root-only init script (it would chown
+    # the shared assets volume) is replaced by fsGroup 1000: the same group
+    # the backend runs with, so both can read/write the shared assets.
+    securityContext:
+      pod:
+        runAsNonRoot: true
+        runAsUser: 101
+        runAsGroup: 101
+        fsGroup: 1000
+        fsGroupChangePolicy: Always
+      container:
+        allowPrivilegeEscalation: false
+        readOnlyRootFilesystem: true
+        runAsNonRoot: true
+        capabilities:
+          drop:
+            - ALL
     resources:
       requests:
         cpu: 0.1