feat(secrets): make every Secret configurable via a secrets.* block

Until now the Secrets rendered by this chart were not configurable at all. Their labels were fixed
to the chart defaults, they could not carry annotations, and there was no way to hand in a Secret
that is managed outside of the chart - except for the GPG key, which had its own special case via
`signing.existingSecret`. Users who manage their secrets with an external operator (e.g. External
Secrets, Sealed Secrets) or who need annotations for tooling such as Reloader or Kyverno had no
option but to fork the chart.

A `secrets` section is introduced with one entry per Secret (config, gpg, init, inlineConfig,
metrics), each offering:

  addSHASumAnnotation            add a checksum annotation to the pod template (default: true)
  existingSecret.enabled         reference a Secret that is not managed by this chart
  existingSecret.secretName      name of that Secret
  new.annotations                annotations for the Secret created by the chart
  new.labels                     additional labels for the Secret created by the chart

The `new` sub-key keeps the properties of a chart-managed Secret clearly separated from the
properties of a referenced one, so it is obvious which settings are ignored once `existingSecret` is
enabled. `secretName` rather than `name` mirrors the field the value ends up in, the `secretName` of
a pod volume.

The `gitea.secret.*.name` helpers resolve to the user-provided name when `existingSecret` is
enabled, which means the Deployment volumes and the ServiceMonitor credentials pick it up without
further changes. Enabling `existingSecret` without a name fails the render with a message naming the
full values path, because Helm would otherwise silently create a Secret under the referenced name and
overwrite it.

Only two of the five Secrets had a checksum annotation before, so changes to the init scripts, the
GPG key or the metrics token did not trigger a rollout. Annotations for all five are now rendered,
each gated by `addSHASumAnnotation` and skipped for Secrets the chart does not manage.

Two side effects had to be preserved when a Secret is no longer rendered:

- secret_config.yaml carries the HA assertions (RWX access mode, issue/repo indexer, mutually
  exclusive PostgreSQL dependencies) inside its `assertions` field. They are extracted into
  `gitea.config.assertions` and evaluated before the guard, otherwise providing an own config Secret
  would silently disable chart-wide validation.
- secret_inlineConfig.yaml populates `.Values.gitea.config` as a side effect of
  `gitea.inline_configuration`. Without evaluating it, even NOTES.txt fails on
  `.Values.gitea.config.cache`. The include therefore runs independently of the guard as well.

`signing.existingSecret` keeps working; `secrets.gpg.existingSecret` takes precedence over it. The
error message raised for an enabled but unconfigured signing setup now lists all three options.

Test suites rendering the Deployment have to declare the Secret templates it checksums, hence the
added `templates:` entries. unittests/helm/deployment/extraInitContainers.yaml set `signing.enabled`
without a key or an existing Secret - a combination that fails a real `helm install` and only went
unnoticed because the Deployment never rendered secret_gpg.yaml before.

Co-authored-by: Copilot <copilot@github.com>

unittests/helm/deployment/HA.yaml

@@ -5,7 +5,10 @@ release:
 templates:
   - templates/gitea/deployment.yaml
   - templates/gitea/secret_config.yaml
+  - templates/gitea/secret_gpg.yaml
+  - templates/gitea/secret_init.yaml
   - templates/gitea/secret_inlineConfig.yaml
+  - templates/gitea/secret_metrics.yaml
 tests:
   - it: fails with multiple replicas and "GIT_GC_REPOS" enabled
     template: templates/gitea/secret_config.yaml