fix(helm): make bundled postgres PSA restricted compliant

[officialasishkumar]

Summary

Closes #1560

The bundled PostgreSQL deployment now ships with Pod Security Admission restricted-compliant defaults and exposes both pod-level and container-level security context values for overrides.

• add default RuntimeDefault seccomp profiles for the bundled PostgreSQL pod and container
• drop all container capabilities by default while keeping allowPrivilegeEscalation: false
• move the bundled PostgreSQL pod and container security contexts into chart values so users can customize them without patching templates
• extend Helm unit coverage for the new defaults and override paths

Testing

• make helm-version
• helm unittest helm/kagent
• helm lint helm/kagent

[Copilot]

Pull request overview

Updates the bundled PostgreSQL Helm chart resources to be Pod Security Admission (PSA) restricted compliant by default, while also making both pod-level and container-level security contexts configurable via chart values.

Changes:

• Adds restricted-compliant defaults for bundled PostgreSQL (seccomp RuntimeDefault, drop all capabilities, allowPrivilegeEscalation: false, non-root settings).
• Moves PostgreSQL pod/container securityContext configuration into .Values.database.postgres.bundled.* for user overrides.
• Extends Helm unit tests to cover the new defaults and override behavior.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
helm/kagent/values.yaml	Introduces configurable pod/container security context defaults for bundled PostgreSQL.
helm/kagent/templates/postgresql.yaml	Renders pod/container security contexts from values instead of hardcoding them in the template.
helm/kagent/tests/postgresql_test.yaml	Adds unit assertions for new PSA-restricted defaults and override paths.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.