Fix gitea 28 and openproject 17 deployment issues

- gitea: use rootless image tag (28.2.0-rootless) since deployment
  runs as non-root UID 1000; standard tag uses s6-overlay requiring root
- openproject: add secretKeyBase secret and SECRET_KEY_BASE env var
  to web, worker, and seeder; v17 enforces non-default SECRET_KEY_BASE

openproject/versions/17/manifest.yaml

@@ -17,6 +17,7 @@ defaultConfig:
     host: '{{ .apps.memcached.host }}'
     port: '{{ .apps.memcached.port }}'
 defaultSecrets:
+- key: secretKeyBase
 - key: dbPassword
 - key: adminPassword
 requiredSecrets: