feat(deployment)!: move security contexts into the deployment dict

`podSecurityContext` and `containerSecurityContext` are both Deployment-scoped: the former is rendered into
`spec.template.spec.securityContext`, the latter into the securityContext of the Gitea container and the
chart-managed init containers. Keeping them at the top level hid that pod/container distinction behind a
naming convention and separated them from the other pod- and container-scoped settings that already live
under `deployment` and `deployment.gitea`.

`podSecurityContext` therefore becomes `deployment.securityContext` and `containerSecurityContext` becomes
`deployment.gitea.securityContext`, which makes the scope obvious from the values path alone and continues
the consolidation started with `deployment.gitea.env`, `deployment.gitea.resources` and
`deployment.gitea.image`.

The template helpers keep their argument-based signatures, because `gitea.containerSecurityContext` is also
used by the Helm test pod and is not bound to a single values path.

Both removed keys are covered by the deprecation check so that a silently dropped security context cannot
lead to containers unexpectedly running as root or without the configured capability set.

BREAKING CHANGE: `podSecurityContext` and `containerSecurityContext` no longer exist. Use
`deployment.securityContext` and `deployment.gitea.securityContext` instead. Installations that still set
the old keys will fail to render unless `checkDeprecation` is set to `false`.

Co-authored-by: Copilot <copilot@github.com>

values.yaml

@@ -101,6 +101,25 @@ deployment:
     #   cpu: 100m
     #   memory: 128Mi
 
+    ## @param deployment.gitea.securityContext Security context of the Gitea container and the chart-managed init containers.
+    securityContext: {}
+    #   allowPrivilegeEscalation: false
+    #   capabilities:
+    #     drop:
+    #       - ALL
+    #   # Add the SYS_CHROOT capability for root and rootless images if you intend to
+    #   # run pods on nodes that use the container runtime cri-o. Otherwise, you will
+    #   # get an error message from the SSH server that it is not possible to read from
+    #   # the repository.
+    #   # https://gitea.com/gitea/helm-gitea/issues/161
+    #     add:
+    #       - SYS_CHROOT
+    #   privileged: false
+    #   readOnlyRootFilesystem: true
+    #   runAsGroup: 1000
+    #   runAsNonRoot: true
+    #   runAsUser: 1000
+
   ## @param deployment.nodeSelector NodeSelector for the deployment
   nodeSelector: {}
 
@@ -126,6 +145,9 @@ deployment:
   ## @param deployment.schedulerName Use an alternate scheduler, e.g. "stork"
   schedulerName: ""
 
+  ## @param deployment.securityContext Pod security context. On non-OpenShift clusters the chart defaults `fsGroup` to `1000` when this map is empty.
+  securityContext: {}
+
   ## @param deployment.strategy.type Deployment strategy used to replace old pods, either `RollingUpdate` or `Recreate`.
   ## @param deployment.strategy.rollingUpdate.maxSurge Number or percentage of pods that may be created above the desired replica count. Only used with `RollingUpdate`.
   ## @param deployment.strategy.rollingUpdate.maxUnavailable Number or percentage of pods that may be unavailable during the update. Only used with `RollingUpdate`.
@@ -281,31 +303,9 @@ openshift:
   enabled: null
   hostUsers: null
 
-## @param podSecurityContext Pod security context. On non-OpenShift clusters the chart defaults `fsGroup` to `1000` when this map is empty.
-podSecurityContext: {}
-
-## @param containerSecurityContext Security context
-containerSecurityContext: {}
-#   allowPrivilegeEscalation: false
-#   capabilities:
-#     drop:
-#       - ALL
-#   # Add the SYS_CHROOT capability for root and rootless images if you intend to
-#   # run pods on nodes that use the container runtime cri-o. Otherwise, you will
-#   # get an error message from the SSH server that it is not possible to read from
-#   # the repository.
-#   # https://gitea.com/gitea/helm-gitea/issues/161
-#     add:
-#       - SYS_CHROOT
-#   privileged: false
-#   readOnlyRootFilesystem: true
-#   runAsGroup: 1000
-#   runAsNonRoot: true
-#   runAsUser: 1000
-
 ## @deprecated The securityContext variable has been split two:
-## - containerSecurityContext
-## - podSecurityContext.
+## - deployment.gitea.securityContext
+## - deployment.securityContext.
 ## @param securityContext Run init and Gitea containers as a specific securityContext
 securityContext: {}