Set pod fsGroup for non-root JNLP SSH key access

We are moving to run jobs on Kubernetes containers instead of the Jenkins built-in node.
JNLP runs non-root(jenkins gid 1000) and could not read the SSH Secret mount.

Add pod securityContext fsGroup 1000 and fsGroupChangePolicy to every podTemplate
so JNLP can use mounted volumes. fsGroup lets the jenkins user read the SSH key
without running JNLP as root.

Signed-off-by: Noam Tsemah <ntsemah@nvidia.com>

Author: ntsemah

src/com/mellanox/cicd/Matrix.groovy

@@ -902,6 +902,9 @@ def runK8(image, branchName, config, axis, steps=config.steps) {
     def imagePullSecrets = parseImagePullSecrets(getConfigVal(config, ['kubernetes', 'imagePullSecrets'], "[]"))
     def yaml = """
 spec:
+  securityContext:
+    fsGroup: 1000
+    fsGroupChangePolicy: OnRootMismatch
   containers:
     - name: ${cname}
       env:
@@ -1426,6 +1429,9 @@ def build_docker_on_k8(image, config) {
     def imagePullSecrets = parseImagePullSecrets(getConfigVal(config, ['kubernetes', 'imagePullSecrets'], "[]"))
     def yaml = """
 spec:
+  securityContext:
+    fsGroup: 1000
+    fsGroupChangePolicy: OnRootMismatch
   containers:
     - name: docker
       env:
@@ -1727,7 +1733,11 @@ def main() {
         label = "worker-${UUID.randomUUID().toString()}"
         println("Cloud launch on ${label}")
 
-        podTemplate(label: label) {
+        podTemplate(label: label, yamlMergeStrategy: merge(), yaml: """spec:
+  securityContext:
+    fsGroup: 1000
+    fsGroupChangePolicy: OnRootMismatch
+""") {
             startPipeline(label)
         }
         return