feat(crd): add security context and resource configuration support

[skhedim]

Add Security Context and Resource Configuration Support to MCPServer CRD

Summary

This PR adds comprehensive security and resource configuration options to the MCPServer CRD, enabling production-ready deployments that follow Kubernetes security best practices and provide fine-grained control over resource allocation and pod scheduling.

---

Motivation

Currently, the MCPServer CRD has limited configuration options for production deployments. Organizations deploying MCP servers in production environments need:

• Security controls: Pod and container security contexts to enforce security policies
• Resource management: CPU/memory requests and limits to ensure predictable resource usage
• Pod scheduling: Node selectors, affinity rules, and tolerations for proper workload placement
• Metadata management: Custom labels and annotations for monitoring, cost allocation, and governance
• Multi-tenancy: Registry credentials and replica configuration for scalable deployments

---

Changes Made

New fields added to MCPServerDeployment:

Security & Access Control

• securityContext – Container-level security context (e.g., runAsNonRoot, capabilities, etc.)
• podSecurityContext – Pod-level security context (e.g., fsGroup, seccompProfile, etc.)
• imagePullSecrets – Registry credentials for private container images

Resource Management

• resources – CPU/memory requests and limits for the main container
• replicas – Number of pod replicas for horizontal scaling

Pod Scheduling

• tolerations – Node tolerations for tainted nodes
• affinity – Pod/node affinity and anti-affinity rules
• nodeSelector – Node selection constraints

Metadata

• labels – Custom labels applied to pods
• annotations – Custom annotations applied to pods

---

New fields added to InitContainerConfig:

• resources – CPU/memory requests and limits for init container
• securityContext – Container-level security context for init container

---

Design Decisions

• Backward Compatibility: All new fields are optional to maintain compatibility with existing MCPServer resources
• Security Context Inheritance: When initContainer.securityContext is not specified, it inherits from the main container's securityContext for consistent security policies
• Kubernetes Standards: Field names and structures follow standard Kubernetes conventions for consistency with other CRDs

[jmhbh]

LGTM