Render privileged securityContext for Gitaly's init-cgroups container

What does this MR do?

Render privileged securityContext for Gitaly's init-cgroups container

Gitaly's init-cgroups container used gitlab.podSecurityContextRoot, a Pod-level securityContext helper. This helper had privileged and allowPrivilegeEscalation removed as invalid PodSecurityContext fields in !4961 (merged), which silently stripped them from init-cgroups too, breaking chown of the cgroup path on clusters requiring them (e.g. OpenShift).

Add gitlab.containerSecurityContextRoot, a generic container-level securityContext helper, use it for init-cgroups, and refactor existing container securityContext helpers to share it. Remove the now-unused gitlab.podSecurityContextRoot.

Changelog: fixed

Closes #6647 (closed)

Co-Authored-By: Claude Sonnet 5 noreply@anthropic.com

Related issues

Author checklist

For general guidance, please follow our Contributing guide.

Required

For anything in this list which will not be completed, please provide a reason in the MR discussion.

• Merge Request Title and Description are up to date, accurate, and descriptive.
• MR targeting the appropriate branch.
• MR has a green pipeline.
• Documentation created/updated.
• Tests added/updated.
• Have you validated that your change works end-to-end on a real cluster deployment?
  • Describe how you did it in a comment.
• Equivalent MR/issue for omnibus-gitlab opened.

Reviewers checklist

• MR has a green pipeline on https://gitlab.com/gitlab-org/charts/gitlab.
• Consider downstream impact to the Operator, as per evaluating impact from changes to GitLab chart.