Seerr config-ownership migration container has no opt-out for PSA-restricted namespaces

[phaedrus1992]

Summary

Follow-up from the #535 pre-pr-review pass (PR for sprint #544). The migrate-config-ownership
init container added for Seerr apps runs as root (uid 0) to conditionally chown the inherited
config volume. As of the fix in that PR, it's now skipped whenever spec.uid/spec.gid/
spec.security are explicitly set or the config volume uses existingClaimName -- which closes
the confused-deputy and uid-mismatch issues, and incidentally gives power users an escape hatch
(set any of those fields to opt out).

But a user who hasn't customized any of those fields, and is deploying into a namespace enforcing
Pod Security Admission restricted (or an equivalent Kyverno/Gatekeeper runAsNonRoot policy),
still gets the root init container injected -- and the whole pod is rejected outright
(runAsNonRoot: false on that one container fails admission), with no way to decline it short of
setting an unrelated field as an incidental workaround.

Proposed fix

Add an explicit, defaulted-off opt-in/opt-out control, e.g.:

• spec.appConfig.seerr.migrateConfigOwnership: bool (schema field), or
• A servarr.dev/skip-config-ownership-migration: "true" annotation the operator honors.

Either lets a user in a restricted namespace explicitly say "don't inject this," independent of
whether they've also customized uid/gid/security.

Context

crates/servarr-resources/src/deployment.rs, build_init_containers (Seerr branch).