[Close #1119] fix(secrets): render inline config as data to prune removed sections

The inline-config Secret used `stringData`. The API server stores it as `data`, so a section removed from `gitea.config` was never pruned from the live Secret, and the init container kept writing it into `app.ini` on every start. With Gitea 28, a leftover `[webhook] ALLOWED_HOST_LIST` overrides `[security]`'s, which breaks webhooks to private hosts.

This renders the Secret as base64 `data` instead.

- `templates/secret_inlineConfig.yaml`: `stringData` → `data` (`b64enc`).
- Unit tests read `data.*` with `decodeBase64: true`; adds a regression test asserting there is no `stringData`.

Note: keys that are already stale from the `stringData` era survive the first upgrade to this version, because Helm's three-way merge never recorded them under `data`. Every removal after that is pruned.

`make unittests-helm`: 261 passed. `helm lint` and `yamllint` are clean.
Co-authored-by: perfectra1n <jonfuller2012@gmail.com>
Reviewed-on: https://gitea.com/gitea/helm-gitea/pulls/1110
Co-authored-by: perfectra1n <49838+perfectra1n@noreply.gitea.com>

unittests/helm/config/server-section_domain.yaml

@@ -8,15 +8,18 @@ tests:
     asserts:
       - documentIndex: 0
         matchRegex:
-          path: stringData.server
+          path: data.server
+          decodeBase64: true
           pattern: \nDOMAIN=git.example.com
       - documentIndex: 0
         matchRegex:
-          path: stringData.server
+          path: data.server
+          decodeBase64: true
           pattern: \nSSH_DOMAIN=git.example.com
       - documentIndex: 0
         matchRegex:
-          path: stringData.server
+          path: data.server
+          decodeBase64: true
           pattern: \nROOT_URL=http://git.example.com
 
   ################################################
@@ -29,15 +32,18 @@ tests:
     asserts:
       - documentIndex: 0
         matchRegex:
-          path: stringData.server
+          path: data.server
+          decodeBase64: true
           pattern: \nDOMAIN=gitea-unittests-http.testing.svc.cluster.local
       - documentIndex: 0
         matchRegex:
-          path: stringData.server
+          path: data.server
+          decodeBase64: true
           pattern: \nSSH_DOMAIN=gitea-unittests-http.testing.svc.cluster.local
       - documentIndex: 0
         matchRegex:
-          path: stringData.server
+          path: data.server
+          decodeBase64: true
           pattern: \nROOT_URL=http://gitea-unittests-http.testing.svc.cluster.local
 
   ################################################
@@ -55,15 +61,18 @@ tests:
     asserts:
       - documentIndex: 0
         matchRegex:
-          path: stringData.server
+          path: data.server
+          decodeBase64: true
           pattern: \nDOMAIN=provided.example.com
       - documentIndex: 0
         matchRegex:
-          path: stringData.server
+          path: data.server
+          decodeBase64: true
           pattern: \nSSH_DOMAIN=provided.example.com
       - documentIndex: 0
         matchRegex:
-          path: stringData.server
+          path: data.server
+          decodeBase64: true
           pattern: \nROOT_URL=http://provided.example.com
 
   ################################################
@@ -77,15 +86,18 @@ tests:
     asserts:
       - documentIndex: 0
         matchRegex:
-          path: stringData.server
+          path: data.server
+          decodeBase64: true
           pattern: \nDOMAIN=route.example.com
       - documentIndex: 0
         matchRegex:
-          path: stringData.server
+          path: data.server
+          decodeBase64: true
           pattern: \nSSH_DOMAIN=route.example.com
       - documentIndex: 0
         matchRegex:
-          path: stringData.server
+          path: data.server
+          decodeBase64: true
           pattern: \nROOT_URL=http://route.example.com
 
   ################################################
@@ -101,7 +113,8 @@ tests:
     asserts:
       - documentIndex: 0
         matchRegex:
-          path: stringData.server
+          path: data.server
+          decodeBase64: true
           pattern: \nROOT_URL=https://route.example.com
 
   ################################################
@@ -123,15 +136,18 @@ tests:
     asserts:
       - documentIndex: 0
         matchRegex:
-          path: stringData.server
+          path: data.server
+          decodeBase64: true
           pattern: \nDOMAIN=gw.example.com
       - documentIndex: 0
         matchRegex:
-          path: stringData.server
+          path: data.server
+          decodeBase64: true
           pattern: \nSSH_DOMAIN=gw.example.com
       - documentIndex: 0
         matchRegex:
-          path: stringData.server
+          path: data.server
+          decodeBase64: true
           pattern: \nROOT_URL=http://gw.example.com
 
   ################################################
@@ -154,5 +170,6 @@ tests:
     asserts:
       - documentIndex: 0
         matchRegex:
-          path: stringData.server
+          path: data.server
+          decodeBase64: true
           pattern: \nROOT_URL=https://gw.example.com