config(security): Updating security context handling

[alix-graylog]

Summary

Adding podSecurityContext and containerSecurityContext as configurable values for the Graylog app, DataNode, and GeoIP CronJob — allowing clusters enforcing restricted Pod Security Standards.

What changed

• Graylog app: refactors the previously hardcoded runAsUser/runAsGroup/fsGroup: 1100 into values.yaml and exposes containerSecurityContext for per-container hardening (e.g. capabilities.drop: [ALL]).

• DataNode: adds pod and container security context support. runAsUser/runAsGroup are intentionally omitted from defaults because the container image starts as root to run chown and setpriv --init-groups before dropping to uid 999 - setting runAsUser at the pod level breaks that flow. Only fsGroup: 999 and fsGroupChangePolicy: OnRootMismatch are defaulted, which handles volume ownership without - interfering with the image's privilege dropping.

• GeoIP CronJob: passes graylog.podSecurityContext through to the job spec helper
  (graylog.geoip.job.spec) instead of hardcoding runAsUser/runAsGroup/fsGroup: 1100.

Checklist

• Tests added/updated
• Documentation updated
• This PR includes a new feature
• This PR includes a bugfix
• This PR includes a refactor

Testing Checklist

Static Validation

• helm lint ./graylog passes
• helm template graylog ./graylog --validate passes

Installation

• Fresh installation completes successfully
• All pods reach Running state
• helm test graylog -n graylog passes

Functional (if applicable)

• Web UI accessible and login works
• DataNodes visible in System > Data Nodes
• Inputs can be created and receive data

Upgrade (if applicable)

• Upgrade from previous release succeeds
• Scaling up/down works correctly
• Configuration changes apply correctly

Specific to this PR

• describe what was specifically tested

Notes for reviewers

• Verify all tests pass
• Sync up with the author before merging
• The commit history must be preserved - please use the rebase-merge or standard merge options

[alix-graylog]

We need to update the Github Action helm linter's access, but the tests it runs pass locally

➜  graylog git:(security-contexts) ✗ pwd
/Users/alix/Programming/repos/graylog-helm/charts/graylog
➜  graylog git:(security-contexts) ✗ helm lint
==> Linting .

1 chart(s) linted, 0 chart(s) failed
```