chore: Add CAP_CHOWN to Container Run capabilities

[tolusha]

What does this PR do?

• Adds the CHOWN Linux capability to the default security context for workspace containers when container run mode is enabled (alongside the existing SETGID and SETUID capabilities). This allows containers to change file ownership, needed for nested container scenarios.
• For existing CheCluster CRs that already have SETGID/SETUID capabilities configured but are missing CHOWN, a new migration action (updateDevEnvironmentsContainerRunConfiguration) automatically appends CHOWN to the capabilities list during reconciliation.
• Enables the reconciler to update existing SCCs by fetching the current object, applying desired spec fields on top, and syncing with diff detection (diffs.SecurityContextConstraints) — rather than only setting fields
  at creation time. This ensures existing SCCs get updated when the operator changes (e.g., to add CHOWN) and avoids endless reconcile loops.

Screenshot/screencast of this PR

N/A

What issues does this PR fix or reference?

eclipse-che/che#23748

How to test this PR?

1. Deploy the operator:

OpenShift

./build/scripts/olm/test-catalog-from-sources.sh

or

build/scripts/docker-run.sh /bin/bash -c "
  oc login \
    --token=<...> \
    --server=<...> \
    --insecure-skip-tls-verify=true && \
  build/scripts/olm/test-catalog-from-sources.sh
"

on Minikube

./build/scripts/minikube-tests/test-operator-from-sources.sh

Common Test Scenarios

• Deploy/update Eclipse Che
• Start an empty workspace
• Open terminal and build/run an image
• Stop a workspace
• Check operator logs for reconciliation errors or infinite reconciliation loops

PR Checklist

As the author of this Pull Request I made sure that:

• The Eclipse Contributor Agreement is valid
• Code produced is complete
• Code builds without errors
• Tests are covering the bugfix
• The repository devfile is up to date and works
• Relevant user documentation updated
• Relevant contributing documentation updated
• CI/CD changes implemented, documented and communicated

Reviewers

Reviewers, please comment how you tested the PR when approving it.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: rohanKanojia, tolusha

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[tolusha]

/retest