feat(deployment)!: move security contexts into the deployment dict

`podSecurityContext` and `containerSecurityContext` are both Deployment-scoped: the former is rendered into
`spec.template.spec.securityContext`, the latter into the securityContext of the Gitea container and the
chart-managed init containers. Keeping them at the top level hid that pod/container distinction behind a
naming convention and separated them from the other pod- and container-scoped settings that already live
under `deployment` and `deployment.gitea`.

`podSecurityContext` therefore becomes `deployment.securityContext` and `containerSecurityContext` becomes
`deployment.gitea.securityContext`, which makes the scope obvious from the values path alone and continues
the consolidation started with `deployment.gitea.env`, `deployment.gitea.resources` and
`deployment.gitea.image`.

The template helpers keep their argument-based signatures, because `gitea.containerSecurityContext` is also
used by the Helm test pod and is not bound to a single values path.

Both removed keys are covered by the deprecation check so that a silently dropped security context cannot
lead to containers unexpectedly running as root or without the configured capability set.

BREAKING CHANGE: `podSecurityContext` and `containerSecurityContext` no longer exist. Use
`deployment.securityContext` and `deployment.gitea.securityContext` instead. Installations that still set
the old keys will fail to render unless `checkDeprecation` is set to `false`.

Co-authored-by: Copilot <copilot@github.com>

unittests/helm/deployment/deprecations.yaml

@@ -23,6 +23,13 @@ tests:
     asserts:
       - failedTemplate:
           errorMessage: "`affinity` does no longer exist. Please refer to the changelog and configure `deployment.affinity` instead."
+  - it: fails when the removed `containerSecurityContext` value is set
+    set:
+      containerSecurityContext:
+        runAsUser: 1000
+    asserts:
+      - failedTemplate:
+          errorMessage: "`containerSecurityContext` does no longer exist. Please refer to the changelog and configure `deployment.gitea.securityContext` instead."
   - it: fails when the removed `deployment.env` value is set
     set:
       deployment.env:
@@ -52,6 +59,13 @@ tests:
     asserts:
       - failedTemplate:
           errorMessage: "`priorityClassName` does no longer exist. Please refer to the changelog and configure `deployment.priorityClassName` instead."
+  - it: fails when the removed `podSecurityContext` value is set
+    set:
+      podSecurityContext:
+        fsGroup: 1000
+    asserts:
+      - failedTemplate:
+          errorMessage: "`podSecurityContext` does no longer exist. Please refer to the changelog and configure `deployment.securityContext` instead."
   - it: fails when the removed `resources` value is set
     set:
       resources:
@@ -101,6 +115,8 @@ tests:
       checkDeprecation: false
       affinity:
         nodeAffinity: {}
+      containerSecurityContext:
+        runAsUser: 1000
       deployment.env:
         - name: VARIABLE
           value: my-value
@@ -109,6 +125,8 @@ tests:
           - 192.0.2.1
       nodeSelector:
         foo: bar
+      podSecurityContext:
+        fsGroup: 1000
       priorityClassName: high-priority
       replicaCount: 2
       resources:

unittests/helm/deployment/openshift.yaml

@@ -80,11 +80,13 @@ tests:
       openshift:
         enabled: true
         hostUsers: true
-      podSecurityContext:
-        fsGroup: 1000620000
-      containerSecurityContext:
-        runAsUser: 1000620000
-        runAsGroup: 1000620000
+      deployment:
+        securityContext:
+          fsGroup: 1000620000
+        gitea:
+          securityContext:
+            runAsUser: 1000620000
+            runAsGroup: 1000620000
     asserts:
       - equal:
           path: spec.template.spec.hostUsers