Java init container missing securityContext breaks restricted Pod Security Standard

## What happened?

The Java auto-instrumentation init container (`opentelemetry-auto-instrumentation-java`) is created without any `securityContext`, causing pod creation to fail in namespaces enforcing `pod-security.kubernetes.io/enforce: restricted`.

## Error

```
Error creating: pods "app-789564bdf9-c6wm4" is forbidden: violates PodSecurity
"restricted:latest": allowPrivilegeEscalation != false (container
"opentelemetry-auto-instrumentation-java" must set
securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container
"opentelemetry-auto-instrumentation-java" must set
securityContext.capabilities.drop=["ALL"]), seccompProfile (pod or container
"opentelemetry-auto-instrumentation-java" must set
securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")
```

## Root Cause

In `pkg/instrumentation/sdk.go`, `setInitContainerSecurityContext` is commented out for Java due to upstream opentelemetry-operator#2272 (runAsNonRoot conflict with root-based Java agent image). However, this leaves the init container with no `securityContext` at all, violating the restricted Pod Security Standard.

Other languages (NodeJS, Python, DotNet, Apache) are not affected — they all call `setInitContainerSecurityContext`.

## Expected behavior

The Java init container should receive a minimal restricted-compliant `securityContext`:
- `allowPrivilegeEscalation: false`
- `capabilities.drop: ["ALL"]`
- `seccompProfile.type: RuntimeDefault`

Without setting `runAsNonRoot` or `runAsUser` (to avoid the #2272 conflict).

## Environment

- EKS add-on: amazon-cloudwatch-observability
- Namespace PSS: `restricted:latest`
- Deployment: Pod-level `runAsUser: 1001`, `runAsNonRoot: true`, full restricted `securityContext` on app container

## Reproduction

1. Create namespace with `pod-security.kubernetes.io/enforce: restricted`
2. Install amazon-cloudwatch-observability EKS add-on
3. Deploy a Java app with `instrumentation.opentelemetry.io/inject-java: "true"` and restricted-compliant `securityContext`
4. Observe `FailedCreate` event on the ReplicaSet

## Fix

Submitted in #360.

Read pkg/instrumentation/sdk.go, starting with setInitContainerSecurityContext and the Java-specific path. Compare the Java init container behavior with the other language paths and verify that the resulting securityContext includes the three restricted-policy fields while leaving runAsNonRoot and runAsUser unset; the fix is already noted as submitted in #360.

Written by the indexing model from the issue text.