fix(clickhouse): upgrade ClickHouse Operator to v0.27.0

[jothilal22]

Fixes #852

Summary

Upgrades the bundled ClickHouse Operator from v0.21.2 → v0.27.0 to fix
container-level securityContext being silently dropped during Pod reconciliation.

---

Problem

Users deploying SigNoz in security-hardened Kubernetes clusters (GKE, EKS, AKS,
OpenShift, Kyverno/Gatekeeper enforced) were unable to enforce Pod Security
Admission restricted policy on ClickHouse pods.

The root cause: ClickHouse Operator v0.21.2 silently drops
containers[].securityContext during reconciliation. Fields explicitly set in
the ClickHouseInstallation spec including allowPrivilegeEscalation,
capabilities, and seccompProfile are stripped before the Pod is created.

This means even when the Helm chart is correctly configured, the resulting Pod contains:

securityContext: null 

Kubernetes does not inherit these fields from pod-level securityContext —
they must be set at the container level:

Field	Pod-level	Container-level
allowPrivilegeEscalation	❌	✅ Required
capabilities	❌	✅ Required
seccompProfile	✅	✅ Required
privileged	❌	✅ Require

This caused:

Admission failures in PSA restricted clusters
Security/compliance violations in regulated environments
Inability to run ClickHouse as non-root

Root Cause
The SigNoz chart was shipping ClickHouse Operator v0.21.2, released over
3 years ago. This was confirmed by an Altinity maintainer:

It is using 0.21.2 operator version that is more than 3 years old.
Please try changing version in the chart." — @alex-zaitsev, Altinity (Operator maintainer)

Operator versions v0.25+, v0.26+, and v0.27.0 all correctly propagate
containers[].securityContext into reconciled Pods.

Changes

File	Change
charts/clickhouse/values.yaml	clickhouseOperator.version + image tags: 0.21.2 → 0.27.0
crds/clickhouseinstallations.clickhouse.altinity.com.yaml	Updated to v0.27.0 schema
crds/clickhouseinstallationtemplates.clickhouse.altinity.com.yaml	Updated to v0.27.0 schema
crds/clickhouseoperatorconfigurations.clickhouse.altinity.com.yaml	Updated to v0.27.0 schema

How to Verify

kubectl get pod <chi-pod-name> -n <namespace> \
  -o jsonpath='{.spec.containers[*].securityContext}'

Before this fix: null

After this fix: {"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},...}

Backward Compatibility

1. No behavior change for users not setting container-level securityContext
   2.Fully backward compatible — existing deployments unaffected
   3.Upstream CRD schemas sourced directly from the official Altinity Helm chart