fix(uptime-kuma): drop NET_RAW so the pod passes baseline Pod Security

[PragalvaXFREZ]

What broke

After #73 synced, the ReplicaSet could not create a pod:

violates PodSecurity "baseline:latest": non-default capabilities (container "uptime-kuma" must not include "NET_RAW" in securityContext.capabilities.add)

Baseline permits only the Docker default capability set on add, and NET_RAW is not in it. The PVC, policy, and Service applied fine; only the pod was blocked.

Fix

• Remove NET_RAW from securityContext.capabilities.add. All capabilities stay dropped.
• Remove the ICMP egress rule from the CiliumNetworkPolicy, since nothing can use it now.
• README: HTTP and TCP checks only; ping monitors listed as a known limitation with the reason.

Raising the namespace to privileged for a ping feature nobody asked for is the wrong trade. HTTP checks and the Discord webhook are the use case.

Validation

• helm template render contains no NET_RAW.
• kubeconform -strict and scripts/check-docs.py pass.

After merge

kubectl -n uptime get pod -o wide

The pod must reach Running on talos-lqv-w4u.