[security] scale-zero-pg static base-tier manifests: container-level restricted securityContext #2586

packages/scale-zero-pg/deploy/20-compute.yaml, 25-compute-warm.yaml and 26-compute-ro.yaml set only a pod-level seccomp profile. Bring every container in them to the restricted profile already applied to the rendered per-app compute pods: allowPrivilegeEscalation:false, drop ALL, seccomp RuntimeDefault, runAsNonRoot with numeric runAsUser/runAsGroup 1000 (the images name non-numeric users postgres/neon). Check them with the pod-security-admission restricted evaluator against the parsed manifests, mutation-proved. Then run the OKE drill battery (deploy/_verify-*.sh) at the next OKE verification to prove a full Postgres boot. Deferred from #2585 (#2564).