Matrix-Synapse chart: security hardening, naming scheme, configurable probes

- Values-driven securityContext for the Synapse pod/container with hardened
  defaults: runAsNonRoot as uid/gid 1000 (matching the image's previous gosu
  drop target), readOnlyRootFilesystem, allowPrivilegeEscalation false, all
  capabilities dropped; /tmp mounted as emptyDir. The now-ineffective UID/GID
  env vars are removed (the securityContext controls the user).
- Naming scheme: delegation Deployment renamed to ...-delegation-nginx-deployment,
  ConfigMap to ...-delegation-nginx-configmap (references and service selector
  updated).
- matrix.configSecretRef moved to secrets.configSecretRef (repo standard).
- Probes for Synapse and the delegation nginx are values-configurable;
  defaults are the previous hardcoded settings.
- Flexible ingress standard: ingress.className (default nginx) and
  ingress.annotations merged with the cert-manager annotation.
- Additive matrix.env block rendered through tpl (value/secretKeyRef/
  configMapKeyRef forms).
- CI fixtures: secret ref moved, seed job image synced to appVersion.
- Chart 4.2.1+upv1.159.0 -> 5.0.0+upv1.159.0 (major; app version unchanged).

ci/matrix-synapse/fixtures.yaml

@@ -40,7 +40,7 @@ spec:
       containers:
         - name: generate
           # Same image the chart deploys (appVersion of matrix-synapse).
-          image: ghcr.io/element-hq/synapse:v1.149.1
+          image: ghcr.io/element-hq/synapse:v1.159.0
           args: ["generate"]
           env:
             - name: SYNAPSE_SERVER_NAME

ci/matrix-synapse/test-values.yaml

@@ -1,6 +1,8 @@
+secrets:
+  configSecretRef: op://ci/matrix-synapse-config
+
 matrix:
   serverName: synapse.ci.local
-  configSecretRef: op://ci/matrix-synapse-config
   delegation:
     enabled: true
     serverUrl: ci.local