feat(helm): add sidecar resources and pool config

User code runs in sidecar's cgroup via nsenter, not the main
container's. This change makes sidecar resources configurable so
operators can allocate appropriate CPU/memory for user code execution.