[K8S][HELM] Support container security context and StatefulSet annotations

[akirn]

Why are the changes needed?

The chart only exposes a pod-level securityContext. Fields such as allowPrivilegeEscalation, readOnlyRootFilesystem and capabilities exist only on the container securityContext, so clusters whose admission policies require them (for example Pod Security Standards "restricted", or Kyverno/Gatekeeper equivalents) can't run the chart without patching the template. This adds a containerSecurityContext value applied to the kyuubi-server container, as the Apache Polaris and Dagster charts already offer.

It also adds an annotations value for the StatefulSet's own metadata. podAnnotations only reaches the pod template, but some controllers read the workload's annotations. For example, Stakater Reloader' secret.reloader.stakater.com/reload must be on the StatefulSet to roll the pods when a TLS keystore Secret is renewed, since the Kyuubi server reads its keystore only at startup.

Both values default to {}, so the rendered output is unchanged for existing users.

How was this patch tested?

The chart has no unit tests, so this was checked by rendering:

1. helm lint charts/kyuubi passes.
2. With default values, helm template t charts/kyuubi is byte-identical to master.
3. With both values set:

helm template t charts/kyuubi -s templates/kyuubi-statefulset.yaml --set-json 'annotations={"secret.reloader.stakater.com/reload":"kyuubi-tls"}' --set-json
  'containerSecurityContext={"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true,"capabilities":{"drop":["ALL"]}}'
  the annotation renders under the StatefulSet's `metadata.annotations` and the security context under the `kyuubi-server` container. The output passes `kubectl apply --dry-run=client`.

Was this patch assisted by generative AI tooling?

No. The patch wasn't assisted. The description was.

cc @pan3793 @dnskr

[github-actions]

Hello @akirn,
Thanks for finding the time to submit the Pull request, the Kyuubi community thanks you！
We really appreciate the community's efforts to improve Apache Kyuubi.
If you are new to Apache Kyuubi for code changes, please take some time to read our contributing guide.