feat(deployment)!: move extraVolumes and extraContainerVolumeMounts into the deployment dict

Both values are Deployment-scoped: `extraVolumes` is rendered into `spec.template.spec.volumes` and
`extraContainerVolumeMounts` only into the volumeMounts of the Gitea container. The `extra*` prefix said
nothing about that scope and left them sitting at the top level, far away from the pod- and container-scoped
settings that already live under `deployment` and `deployment.gitea`.

They therefore become `deployment.volumes` and `deployment.gitea.volumeMounts`, which makes the target
resource and container obvious from the values path alone and continues the consolidation started with
`deployment.gitea.env`, `deployment.gitea.image`, `deployment.gitea.resources` and the security contexts.

`extraInitVolumeMounts` stays where it is for now, because it targets the init containers rather than the
Gitea container. The deprecated `extraVolumeMounts` fallback is kept intact and now points at
`deployment.gitea.volumeMounts` in its documentation.

Both removed keys are covered by the deprecation check, because silently ignoring them would drop mounted
TLS certificates, custom themes or client certs and leave Gitea running with a broken or unexpected
configuration.

BREAKING CHANGE: `extraVolumes` and `extraContainerVolumeMounts` no longer exist. Use `deployment.volumes`
and `deployment.gitea.volumeMounts` instead. Installations that still set the old keys will fail to render
unless `checkDeprecation` is set to `false`.

Co-authored-by: Copilot <copilot@github.com>

docs/gateway-api.md

@@ -122,7 +122,7 @@ verify the backend certificate before forwarding the request.
 
 Gitea serves HTTPS via three `[server]` app.ini options
 ([cheat sheet](https://docs.gitea.com/administration/config-cheat-sheet#server-server)). Mount the
-cert/key with `extraVolumes` + `extraContainerVolumeMounts` and point Gitea at them with absolute paths:
+cert/key with `deployment.volumes` + `deployment.gitea.volumeMounts` and point Gitea at them with absolute paths:
 
 ```yaml
 gitea:
@@ -132,14 +132,16 @@ gitea:
       CERT_FILE: /etc/gitea-tls/tls.crt
       KEY_FILE: /etc/gitea-tls/tls.key
 
-extraVolumes:
-  - name: gitea-tls
-    secret:
-      secretName: gitea-backend-tls   # cert-manager-issued Secret, etc.
-extraContainerVolumeMounts:
-  - name: gitea-tls
-    mountPath: /etc/gitea-tls
-    readOnly: true
+deployment:
+  gitea:
+    volumeMounts:
+      - name: gitea-tls
+        mountPath: /etc/gitea-tls
+        readOnly: true
+  volumes:
+    - name: gitea-tls
+      secret:
+        secretName: gitea-backend-tls   # cert-manager-issued Secret, etc.
 ```
 
 - Relative `CERT_FILE`/`KEY_FILE` values resolve against Gitea's `CustomPath` (`/data/gitea` in the