docs: document security hardening (PSS restricted profile, PYTHONPATH blocking)

## Summary

KServe v0.18 added two security hardening features that are not documented:

1. **Pod Security Standards (PSS) restricted profile enforcement** for LLMInferenceService default templates — workload pods now run with minimal privileges by default (no root, dropped Linux capabilities, no privilege escalation)
2. **PYTHONPATH environment variable blocking** in ISVC and ServingRuntime webhooks — prevents potential code injection via PYTHONPATH manipulation

## What needs to be documented

- PSS restricted profile enforcement behavior and implications for custom containers
- PYTHONPATH blocking: what users should know if they were previously setting PYTHONPATH
- Any workarounds or configuration options if users need to customize security contexts

## Related PRs

- https://github.com/kserve/kserve/pull/5302 (PSS restricted profile)
- https://github.com/kserve/kserve/pull/5340 (PYTHONPATH blocking)

## Since

KServe v0.18

Start by reading related PRs 5302 and 5340 to confirm the PSS restricted profile and PYTHONPATH blocking behavior. Locate the relevant KServe user documentation sections, then document custom-container implications, previously configured PYTHONPATH behavior, and supported workarounds or configuration options. Done means users can understand both security changes and how to adapt their deployments.

Written by the indexing model from the issue text.