Add security context to meet PodSecurity restricted standard

- Set runAsNonRoot and runAsUser to 65534 (nobody)
- Disable privilege escalation
- Drop all Linux capabilities
- Use RuntimeDefault seccomp profile
- Applies to both migration job and main deployment

k8s/deployment.yaml

@@ -16,10 +16,25 @@ spec:
     spec:
       imagePullSecrets:
       - name: gitlab-registry
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65534
+        fsGroup: 65534
+        seccompProfile:
+          type: RuntimeDefault
       containers:
       - name: towerops
         image: registry.gitlab.com/graham/towerops:latest
         imagePullPolicy: Always
+        securityContext:
+          allowPrivilegeEscalation: false
+          runAsNonRoot: true
+          runAsUser: 65534
+          capabilities:
+            drop:
+            - ALL
+          seccompProfile:
+            type: RuntimeDefault
         ports:
         - containerPort: 4000
           name: http

k8s/migrate-job.yaml

@@ -20,10 +20,25 @@ spec:
       restartPolicy: Never
       imagePullSecrets:
       - name: gitlab-registry
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65534
+        fsGroup: 65534
+        seccompProfile:
+          type: RuntimeDefault
       containers:
       - name: migrate
         image: registry.gitlab.com/graham/towerops:IMAGE_TAG
         command: ["/app/bin/towerops", "eval", "Towerops.Release.migrate()"]
+        securityContext:
+          allowPrivilegeEscalation: false
+          runAsNonRoot: true
+          runAsUser: 65534
+          capabilities:
+            drop:
+            - ALL
+          seccompProfile:
+            type: RuntimeDefault
         env:
         - name: MIX_ENV
           value: "prod"