fix(argo-cd): Omit runAsUser for dex when deployed on OpenShift

[CLNRMN]

Checklist:

• I have bumped the chart version according to versioning
• I have updated the documentation according to documentation
• I have updated the chart changelog with all the changes that come with this pull request according to changelog.
• Any new values are backwards compatible and/or have sensible default.
• I have signed off all my commits as required by DCO.
• I have created a separate pull request for each chart according to pull requests
• My build is green (troubleshooting builds).

fix(argo-cd): Omit runAsUser for dex when deployed on OpenShift

Context

PR #3749 updated the dex Docker image to v2.45.1 and introduced a hardcoded runAsUser: 1001 in the dex containerSecurityContext. This broke deployments on OpenShift.

On OpenShift, the restricted / restricted-v2 SCC (Security Context Constraint) assigns UIDs from a namespace-specific range. A hardcoded runAsUser value like 1001 falls outside that allocated range and is rejected, preventing the dex pod from starting.

What changed

In charts/argo-cd/templates/dex/deployment.yaml, the securityContext rendering for both the dex container and the copyutil init container now conditionally omits runAsUser when openshift.enabled is true:

{{- if $.Values.openshift.enabled }}
  {{- omit . "runAsUser" | toYaml | nindent 10 }}
{{- else }}
  {{- toYaml . | nindent 10 }}
{{- end }}

By omitting runAsUser when openshift.enabled is set, OpenShift's SCC can assign a valid UID from the namespace's allocated range automatically, allowing the dex pod to start successfully.

[mbevc1]

I cannot test this, but it's a follwo-up from a previous PR

[CLNRMN]

@mbevc1 Here are some more details about the diff, so you could have a better insight:

Default values.yaml (with the runAsUser set to 1001)

helm template . -f values.yaml --set=openshift.enabled=false | yq 'select(.kind == "Deployment" and .metadata.name == "release-name-argocd-dex-server") | .spec.template.spec | {"initContainers": .initContainers[0].securityContext, "containers": .containers[0].securityContext }'       
initContainers:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
      - ALL
  readOnlyRootFilesystem: true
  runAsNonRoot: true
  runAsUser: 1001
  seccompProfile:
    type: RuntimeDefault
containers:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
      - ALL
  readOnlyRootFilesystem: true
  runAsNonRoot: true
  runAsUser: 1001
  seccompProfile:
    type: RuntimeDefault

values.yaml with openshift.enabled=enabled, the runAsUser is dropped, so OpenShift handles it as before the PR #3749

helm template . -f values.yaml --set=openshift.enabled=enabled | yq 'select(.kind == "Deployment" and .metadata.name == "release-name-argocd-dex-server") | .spec.template.spec | {"initContainers": .initContainers[0].securityContext, "containers": .containers[0].securityContext }'
initContainers:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
      - ALL
  readOnlyRootFilesystem: true
  runAsNonRoot: true
  seccompProfile:
    type: RuntimeDefault
containers:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
      - ALL
  readOnlyRootFilesystem: true
  runAsNonRoot: true
  seccompProfile:
    type: RuntimeDefault

[jmeridth]

@CLNRMN please fix the conflict. Thank you for this contribution.