feat(secrets)!: replace the signing object with secrets.gpg

The `signing` object was the last Secret-related configuration living outside of the `secrets` section introduced in the
previous commit. Keeping it separate meant that the GPG key Secret was the only one without configurable annotations,
labels and a proper `existingSecret` reference, and users had to learn two different conventions for the same concept.

`signing` is therefore removed and fully replaced by `secrets.gpg`:

  signing.enabled        -> secrets.gpg.enabled
  signing.gpgHome        -> secrets.gpg.new.gpgHome
  signing.privateKey     -> secrets.gpg.new.privateKey
  signing.existingSecret -> secrets.gpg.existingSecret.{enabled,secretName}

`gpgHome` is now stored as a key inside the GPG key Secret and consumed via `secretKeyRef` instead of being rendered as
a plain environment variable value. This keeps the whole GPG configuration in a single object, so an operator can hand
over one Secret that fully describes the signing setup instead of splitting it across values and Secret data. The key
names of an externally provided Secret are configurable via `secrets.gpg.existingSecret.gpgHomeKey` and
`secrets.gpg.existingSecret.privateKeyKey`, because chart-defined key names cannot be assumed for Secrets that are
managed by an external system such as an operator or a secret store.

To avoid silently ignoring a now unknown value, `deprecation.yaml` fails the render when `signing` is still set and
points to `secrets.gpg`. As with the other deprecation guards it can be bypassed via `checkDeprecation: false`.

The unit tests are migrated accordingly and the `GNUPGHOME` assertions now verify the `secretKeyRef` shape. Two new
cases cover custom `gpgHomeKey` and `privateKeyKey` values of an existing Secret.

The README gains a `To 13.0.0` upgrade section documenting this change together with the `secrets.*` block and the
Secret renames of the preceding commits.

BREAKING CHANGE: The `signing` object has been removed and is replaced by `secrets.gpg`. Rendering fails if `signing`
is still set. Secrets referenced via `secrets.gpg.existingSecret` now additionally require a `gpgHome` key next to
`privateKey`.

Co-authored-by: Copilot <copilot@github.com>

values.yaml

@@ -362,20 +362,35 @@ secrets:
       labels: {}
 
   gpg:
+    ## @param secrets.gpg.enabled Enable mounting of a GPG key to sign git commits.
+    enabled: false
+
     ## @param secrets.gpg.addSHASumAnnotation Add a pod annotation with the SHA sum of the GPG key Secret to trigger a rollout on change
     addSHASumAnnotation: true
 
     ## @param secrets.gpg.existingSecret.enabled Use an already existing Secret instead of creating the GPG key Secret
     ## @param secrets.gpg.existingSecret.secretName Name of the already existing GPG key Secret
+    ## @param secrets.gpg.existingSecret.gpgHomeKey Key of the GPG home directory in the existing GPG key Secret
+    ## @param secrets.gpg.existingSecret.privateKeyKey Key of the private key in the existing GPG key Secret.
     existingSecret:
       enabled: false
       secretName: ""
+      gpgHomeKey: gpgHome
+      privateKeyKey: privateKey
 
     ## @param secrets.gpg.new.annotations Annotations for the GPG key Secret
     ## @param secrets.gpg.new.labels Labels for the GPG key Secret
+    ## @param secrets.gpg.new.gpgHome Path to the GPG home directory.
+    ## @param secrets.gpg.new.privateKey Content of the private GPG key in armored format.
     new:
       annotations: {}
       labels: {}
+      gpgHome: /data/git/.gnupg
+      privateKey: ""
+      # privateKey: |-
+      #   -----BEGIN PGP PRIVATE KEY BLOCK-----
+      #   ...
+      #   -----END PGP PRIVATE KEY BLOCK-----
 
   init:
     ## @param secrets.init.addSHASumAnnotation Add a pod annotation with the SHA sum of the init Secret to trigger a rollout on change
@@ -532,23 +547,6 @@ initContainers:
       cpu: 100m
       memory: 128Mi
 
-# Configure commit/action signing prerequisites
-## @section Signing
-#
-## @param signing.enabled Enable commit/action signing
-## @param signing.gpgHome GPG home directory
-## @param signing.privateKey Inline private gpg key for signed internal Git activity
-## @param signing.existingSecret Use an existing secret to store the value of `signing.privateKey`
-signing:
-  enabled: false
-  gpgHome: /data/git/.gnupg
-  privateKey: ""
-  # privateKey: |-
-  #   -----BEGIN PGP PRIVATE KEY BLOCK-----
-  #   ...
-  #   -----END PGP PRIVATE KEY BLOCK-----
-  existingSecret: ""
-
 ## @section Gitea
 #
 gitea: