refactor!: remove the deprecated securityContext value

`securityContext` was deprecated when the chart split it into a pod-level and a container-level value. It
only ever acted as a fallback for the runtime container: when the container-level value was empty, the
deprecated map was used instead. That fallback silently changed behaviour depending on whether an unrelated
value happened to be set, and it kept a third security-related values path alive next to
`deployment.securityContext` and `deployment.gitea.securityContext`.

With the fallback gone, `gitea.runtimeContainerSecurityContext` was identical to
`gitea.containerSecurityContext`, so the helper was dropped and the Gitea container now reuses the shared
one. A deprecation check fails the render when the removed value is still set, because silently ignoring it
would drop `runAsUser`, `runAsNonRoot` or the capability set and let the container run with weaker
restrictions than intended.

BREAKING CHANGE: `securityContext` no longer exists. Use `deployment.securityContext` for the pod-level and
`deployment.gitea.securityContext` for the container-level security context. Installations that still set
`securityContext` will fail to render unless `checkDeprecation` is set to `false`.

Co-authored-by: Copilot <copilot@github.com>

templates/_helpers.tpl

@@ -146,17 +146,6 @@ These default to runAsUser 1000 outside OpenShift to preserve existing behavior.
 {{- include "gitea.containerSecurityContext" (list $root $containerSecurityContext) -}}
 {{- end -}}
 
-{{/*
-Render the runtime container securityContext while honoring the deprecated securityContext value.
-*/}}
-{{- define "gitea.runtimeContainerSecurityContext" -}}
-{{- $containerSecurityContext := deepCopy .Values.deployment.gitea.securityContext -}}
-{{- if and (eq (len $containerSecurityContext) 0) .Values.securityContext -}}
-{{- $containerSecurityContext = deepCopy .Values.securityContext -}}
-{{- end -}}
-{{- include "gitea.containerSecurityContext" (list . $containerSecurityContext) -}}
-{{- end -}}
-
 
 {{/*
 Storage Class

templates/gitea/deployment.yaml

@@ -65,7 +65,6 @@ spec:
       {{- $securityContext := include "gitea.deployment.securityContext" . | trim }}
       {{- $containerSecurityContext := include "gitea.containerSecurityContext" (list . (deepCopy .Values.deployment.gitea.securityContext)) | trim }}
       {{- $commandInitContainerSecurityContext := include "gitea.commandInitContainerSecurityContext" (list . (deepCopy .Values.deployment.gitea.securityContext)) | trim }}
-      {{- $runtimeContainerSecurityContext := include "gitea.runtimeContainerSecurityContext" . | trim }}
       {{- if .Values.deployment.schedulerName }}
       schedulerName: "{{ .Values.deployment.schedulerName }}"
       {{- end }}
@@ -405,9 +404,9 @@ spec:
           {{- end }}
           resources:
             {{- toYaml (.Values.deployment.gitea.resources | default dict) | nindent 12 }}
-          {{- if $runtimeContainerSecurityContext }}
+          {{- if $containerSecurityContext }}
           securityContext:
-            {{- $runtimeContainerSecurityContext | nindent 12 }}
+            {{- $containerSecurityContext | nindent 12 }}
           {{- end }}
           volumeMounts:
             - name: temp

templates/gitea/deprecation.yaml

@@ -90,6 +90,11 @@
     {{- fail "`schedulerName` does no longer exist. Please refer to the changelog and configure `deployment.schedulerName` instead." -}}
   {{- end -}}
 
+  {{/* SECURITY CONTEXT */}}
+  {{- if .Values.securityContext -}}
+    {{- fail "`securityContext` does no longer exist. Please refer to the changelog and configure `deployment.securityContext` and `deployment.gitea.securityContext` instead." -}}
+  {{- end -}}
+
   {{/* STRATEGY */}}
   {{- if .Values.strategy -}}
     {{- fail "`strategy` does no longer exist. Please refer to the changelog and configure `deployment.strategy` instead." -}}