refactor(templates)!: centralize Secret names in gitea.secret.*.name helpers

The names of the Secrets rendered by the chart were built inline in each template and, for two of
them, in ad-hoc chart-wide helpers. The same name therefore existed in several places (Deployment
volumes, ServiceMonitor credentials, the Secret templates themselves), which made every rename a
multi-file change and allowed the references to drift apart unnoticed - the Helm unit tests render
one template at a time and cannot detect a mismatching secretName.

All Secret names are now defined once in templates/gitea/_secrets.tpl:

  gitea.secret.config.name        -> <fullname>-config
  gitea.secret.gpg.name           -> <fullname>-gpg-key (or signing.existingSecret)
  gitea.secret.init.name          -> <fullname>-init
  gitea.secret.inlineConfig.name  -> <fullname>-inline-config
  gitea.secret.metrics.name       -> <fullname>-metrics

gitea.gpg-key-secret-name and gitea.metrics-secret-name are removed from _helpers.tpl accordingly.

A checksum/inlineConfig pod annotation is added as well. After the inline configuration had been
split out of secret_config.yaml, changes to it were no longer covered by any checksum annotation and
did not trigger a rollout of the Deployment.

Finally the metadata attributes of the Secret templates are sorted alphabetically as required by the
chart conventions.

BREAKING CHANGE: two Secrets are renamed. The config Secret changes from <fullname> to
<fullname>-config and the metrics Secret from <fullname>-metrics-secret to <fullname>-metrics. Helm
replaces both on upgrade; references to them from outside the chart have to be adjusted.

Co-authored-by: Copilot <copilot@github.com>

templates/gitea/deployment.yaml

@@ -28,6 +28,7 @@ spec:
     metadata:
       annotations:
         checksum/config: {{ include (print $.Template.BasePath "/gitea/secret_config.yaml") . | sha256sum }}
+        checksum/inlineConfig: {{ include (print $.Template.BasePath "/gitea/secret_inlineConfig.yaml") . | sha256sum }}
         {{- range $idx, $value := .Values.gitea.ldap }}
         checksum/ldap_{{ $idx }}: {{ include "gitea.ldap_settings" (list $idx $value) | sha256sum }}
         {{- end }}
@@ -419,18 +420,18 @@ spec:
       volumes:
         - name: init
           secret:
-            secretName: {{ include "gitea.fullname" . }}-init
+            secretName: {{ include "gitea.secret.init.name" . }}
             defaultMode: 110
         - name: config
           secret:
-            secretName: {{ include "gitea.fullname" . }}
+            secretName: {{ include "gitea.secret.config.name" . }}
             defaultMode: 110
         {{- if gt (len .Values.extraVolumes) 0 }}
         {{- toYaml .Values.extraVolumes | nindent 8 }}
         {{- end }}
         - name: inline-config-sources
           secret:
-            secretName: {{ include "gitea.fullname" . }}-inline-config
+            secretName: {{ include "gitea.secret.inlineConfig.name" . }}
         {{- range $idx, $value := .Values.gitea.additionalConfigSources }}
         - name: additional-config-sources-{{ $idx }}
           {{- toYaml $value | nindent 10 }}
@@ -440,7 +441,7 @@ spec:
         {{- if .Values.signing.enabled }}
         - name: gpg-private-key
           secret:
-            secretName: {{ include "gitea.gpg-key-secret-name" . }}
+            secretName: {{ include "gitea.secret.gpg.name" . }}
             items:
               - key: privateKey
                 path: private.asc