[Feature]: Pod securityContext / hardening customizer for Fabric8KubernetesPodRuntime

### Summary

`Fabric8KubernetesPodRuntime.createPod()` provides no way to set a pod/container `securityContext`. For untrusted code-execution sandboxes this blocks standard pod hardening.

### Details

`createPod()` builds `PodSpecBuilder` + `ContainerBuilder` with restartPolicy, image, command/args, resource requests, bind-mounts, nodeSelector and serviceAccount — but there is no hook, `Consumer`, or option to set any of:
- `runAsUser` / `runAsNonRoot` / `fsGroup`
- `readOnlyRootFilesystem`
- `capabilities.drop` (e.g. `ALL`)
- `allowPrivilegeEscalation`
- `seccompProfile` (e.g. `RuntimeDefault`)
- `automountServiceAccountToken: false`

`KubernetesSandboxClientOptions` has no security-context fields either (namespace, image, containerName, workspaceRoot, serviceAccount, nodeSelector, podLabels, cpu/memoryRequest). #1713 (env injection) adds an env map at the same insertion points but does not touch `securityContext`.

### Request

Add a customizer so callers can inject a hardened security posture, e.g.:
- `Consumer` + `Consumer` hooks on the runtime, **or**
- explicit security fields on `KubernetesSandboxClientOptions` (runAsNonRoot, runAsUser, readOnlyRootFilesystem, dropCapabilities, seccompProfile, automountServiceAccountToken, ...).

Same `createPod()` insertion points as #1713. Happy to contribute the PR if the API shape is agreed.