Add Restricted-compatible security contexts

[unixfg]

Summary

• expose pod and container security-context values in the Helm chart
• default the webhook pod to UID 65532 with RuntimeDefault seccomp
• default the container to disallow privilege escalation and drop all Linux capabilities
• document both new chart values

Rationale

The webhook already supports the unprivileged 8443 listener. These defaults make that deployment satisfy Kubernetes Pod Security Restricted while preserving the image's existing non-root UID. Both maps remain configurable, and setting either value to null omits that security context for installations with a different runtime contract.

Files changed

• README.md: documents podSecurityContext and securityContext
• charts/cert-manager-webhook-dnsimple/values.yaml: adds Restricted-compatible defaults
• charts/cert-manager-webhook-dnsimple/templates/deployment.yaml: renders both maps

Validation

• helm lint
• default and null-override helm template renders
• kubeconform strict: 10 valid, 0 invalid/errors, 4 custom-resource schemas skipped
• Kyverno CLI 1.18.2 Pod Security Restricted evaluation: 1 pass, 0 fail/warn/error
• Kubernetes 1.36 server-side dry-run of the full rendered chart
• git diff --check

No DNSimple credentials or Kubernetes Secret contents were accessed or changed while preparing this contribution. A chart version bump is intentionally left to the repository's release workflow.