Fix gitea 28 and openproject 17 deployment issues

- gitea: use rootless image tag (28.2.0-rootless) since deployment
  runs as non-root UID 1000; standard tag uses s6-overlay requiring root
- openproject: add secretKeyBase secret and SECRET_KEY_BASE env var
  to web, worker, and seeder; v17 enforces non-default SECRET_KEY_BASE

openproject/versions/17/web-deployment.yaml

@@ -126,6 +126,11 @@ spec:
             - configMapRef:
                 name: openproject-memcached
           env:
+            - name: SECRET_KEY_BASE
+              valueFrom:
+                secretKeyRef:
+                  name: openproject-secrets
+                  key: secretKeyBase
             - name: OPENPROJECT_DB_PASSWORD
               valueFrom:
                 secretKeyRef: