Guard SecurityContext assignment in StepAction merge (`resolveStepRef`) to prevent silent nil-overwrite

Problem

In pkg/reconciler/taskrun/resources/taskspec.go, resolveStepRef merges a resolved StepAction's fields into the Step that referenced it. Every merged field is guarded so it only overrides the Step's value when the StepAction provides one — except SecurityContext, which is assigned unconditionally:

resolvedStep.SecurityContext = stepFromStepAction.SecurityContext

If a StepAction does not set SecurityContext, this overwrites the Step's SecurityContext with nil, silently discarding any security constraints the Step author set (e.g., runAsNonRoot, readOnlyRootFilesystem).

Impact

The Step falls back to Pod-level security context defaults. No privilege escalation (PodSecurityAdmission still applies), but the Step author's intent is silently dropped, which can be confusing and lead to unexpected behavior.

Proposed Fix

Guard the assignment like other fields:

if stepFromStepAction.SecurityContext != nil {
    resolvedStep.SecurityContext = stepFromStepAction.SecurityContext
}

Context

Reported via a security advisory (closed as not a security vulnerability — nil SC defaults to Pod-level, no privilege escalation).

/kind bug /area api