refactor(serviceAccount)!: group the values into existingServiceAccount and new

The previous notation mixed two concerns in a single flat dict: `create`/`name` decided whether the chart manages the
ServiceAccount or only references an externally provided one, while the remaining keys only ever applied to a
chart-managed ServiceAccount. That made `name` ambiguous, because it either renamed the generated object or pointed to a
foreign one, and it forced the deployment to guard the reference with `or .Values.serviceAccount.create
.Values.serviceAccount.name`.

The values are now grouped the same way as `persistence`, which was restructured in dfe087c. `serviceAccount.enabled`
controls whether the pod uses a ServiceAccount at all, `serviceAccount.existingServiceAccount` references an externally
managed object and `serviceAccount.new` holds the properties of the object created by the chart. The templates follow
the established helper layout in `templates/gitea/_serviceAccounts.tpl`.

Two latent bugs are fixed along the way. The annotation helper was defined as `gitea.secret.admin.annotations`, so the
`gitea.serviceAccount.annotations` include in the template never resolved. And the duplicated name helper
`gitea.serviceAccountName` in `templates/_helpers.tpl` is removed in favour of `gitea.serviceAccount.name`.

BREAKING CHANGE:
- `serviceAccount.create` does no longer exist. Use `serviceAccount.enabled` instead. The default changed from `false`
  to `true`, so a ServiceAccount is now created unless it is explicitly disabled.
- `serviceAccount.name` does no longer exist. Use `serviceAccount.existingServiceAccount.enabled` together with
  `serviceAccount.existingServiceAccount.existingServiceAccountName` to reference an externally managed ServiceAccount.
- `serviceAccount.annotations`, `serviceAccount.labels`, `serviceAccount.automountServiceAccountToken` and
  `serviceAccount.imagePullSecrets` moved below `serviceAccount.new`.

Co-authored-by: Copilot <copilot@github.com>

values.yaml

@@ -82,7 +82,6 @@ deployment:
     image:
       registry: "docker.gitea.com"
       repository: gitea
-      # Overrides the image tag whose default is the chart appVersion.
       tag: ""
       digest: ""
       pullPolicy: IfNotPresent
@@ -869,20 +868,26 @@ service:
 
 
 ## @section ServiceAccount
-## @param serviceAccount.create Enable the creation of a ServiceAccount.
-## @param serviceAccount.name Name of the created ServiceAccount, defaults to release name. Can also link to an externally provided ServiceAccount that should be used.
-## @param serviceAccount.automountServiceAccountToken Enable/disable auto mounting of the service account token.
-## @param serviceAccount.imagePullSecrets Image pull secrets, available to the ServiceAccount.
-## @param serviceAccount.annotations Custom annotations for the ServiceAccount.
-## @param serviceAccount.labels Custom labels for the ServiceAccount.
 serviceAccount:
-  create: false
-  name: ""
-  automountServiceAccountToken: false
-  imagePullSecrets: []
-  # - name: private-registry-access
-  annotations: {}
-  labels: {}
+  ## @param serviceAccount.enabled Assign the pod to use the ServiceAccount.
+  enabled: true
+
+  ## @param serviceAccount.existingServiceAccount.enabled Enable using an existing ServiceAccount.
+  ## @param serviceAccount.existingServiceAccount.existingServiceAccountName Name of the existing ServiceAccount to use.
+  existingServiceAccount:
+    enabled: false
+    existingServiceAccountName: ""
+
+  ## @param serviceAccount.new.annotations Custom annotations for the ServiceAccount.
+  ## @param serviceAccount.new.labels Custom labels for the ServiceAccount.
+  ## @param serviceAccount.new.automountServiceAccountToken Enable/disable auto mounting of the service account token.
+  ## @param serviceAccount.new.imagePullSecrets Image pull secrets, available to the ServiceAccount.
+  new:
+    annotations: {}
+    labels: {}
+    automountServiceAccountToken: false
+    imagePullSecrets: []
+    # - name: private-registry-access
 
 ## @section Persistence
 persistence: