[Helm Chart 1.18.0][OpenShift] rbac.createSCCRoleBinding anyuid RoleBinding missing api-server & dag-processor ServiceAccounts -> pods rejected by SCC (restricted-v2), release fails/times out

### Official Helm Chart version 1.18.0 (latest released) ### Apache Airflow version 3.1.5 ### Kubernetes Version Server Version: v1.31.5 ### Helm Chart configuration # Official Airflow Helm chart chartVersion: 1.18.0 rbac: create: true createSCCRoleBinding: true Components enabled include: - api-server (Deployment + ServiceAccount) - dag-processor (Deployment + ServiceAccount) OpenShift namespace uses default SCC admission (restricted-v2). No custom SCCs were assigned manually. ### Docker Image customizations We use a custom Airflow docker image based on Apache Airflow. However, the issue is not specific to our code: it is an OpenShift SCC admission failure caused by the SCC RoleBinding created by the chart missing component ServiceAccounts (api-server, dag-processor). Without the anyuid SCC binding applied to those SAs, pods are evaluated against restricted-v2 and rejected due to fixed UIDs (e.g. 50000 for Airflow, 65533 for git-sync) and fsGroup=0. ### What happened Installing the Helm chart on OpenShift fails / times out because some pods cannot be created due to SCC admission errors. The chart creates a RoleBinding: - kind: RoleBinding - roleRef: ClusterRole `system:openshift:scc:anyuid` …but the subjects list does NOT include ServiceAccounts for: - `epis-orchestration-airflow-api-server` - `epis-orchestration-airflow-dag-processor` As a result, ReplicaSets for api-server and dag-processor fail to create pods with errors like: - `provider "anyuid": Forbidden: not usable by user or serviceaccount` - `restricted-v2: runAsUser 50000 must be in the ranges: [<project-uid-range>]` - `restricted-v2: fsGroup 0 is not an allowed group` - for dag-processor also: `runAsUser 65533` (git-sync) rejected by restricted-v2 This blocks the installation and results in: `failed post-install ... timed out waiting for the condition`. ### What you think should happen instead When `rbac.createSCCRoleBinding=true`, the chart should include *all enabled component ServiceAccounts*…