fix(helm): default PostgreSQL to the official maintained image

[ojasshelke46]

Fixes #1574

Summary

The chart pulled PostgreSQL from bitnamilegacy/postgresql, the frozen
archive Bitnami moved its free catalog into when it retired free image
maintenance. Never rebuilt, so every PostgreSQL and OS-package CVE
published from now on stays unpatched in it. #1227 moved here as a
stopgap when the free catalog was retired; this is the follow-up
discussed in #1574.

What changed

• Default image is now docker.io/postgres:17.10-trixie
• Data directory moves to /var/lib/postgresql/pgdata — the official
  image has no /bitnami tree, and PGDATA has to be a subdirectory
  the container user creates itself, since /var/lib/postgresql and
  its data subdirectory ship 1777, which Postgres rejects. Volume
  mount path moves accordingly.
• No template changes needed — the subchart drives the image through
  POSTGRES_USER/POSTGRES_PASSWORD/POSTGRES_DB/PGDATA, all
  honored by docker.io/postgres.
• README documents the migration path for existing deployments with
  persistence enabled — in-place PVC reuse does not work, since Bitnami
  keeps postgresql.conf/pg_hba.conf outside the data directory and
  its image was built against a different glibc, so a dump and restore
  is required.
• CHANGELOG entry under Security.

Test plan

Verified on a local kind cluster (deleted after testing):

• helm lint clean
• Fresh install, persistence disabled (default) — pods Ready
• Fresh install, persistence enabled — data survives pod delete/restart
• Migrations apply (18 tables, seeded "Flatcar Container Linux" app)
• /health returns 200
• Omaha /v1/update returns a real package manifest
• Non-default postgresql.auth.username variant works