Outline chart: security hardening, configurable probes, flexible ingress

- Pod and container securityContext are now values-configurable
  (outline.securityContext.pod/container) with hardened defaults:
  runAsNonRoot (uid/gid 1001, the upstream image's nodejs user),
  readOnlyRootFilesystem, allowPrivilegeEscalation false, all
  capabilities dropped. /tmp is mounted as an emptyDir for Outline's
  import/export scratch files.
- Probes moved to values (outline.livenessProbe/readinessProbe/
  startupProbe); defaults are exactly the previously hardcoded ones.
- Ingress raised to the repo standard: ingress.className (default
  nginx), ingress.annotations merged with the always-set annotations,
  ingress.enabled flag; domain/clusterIssuer stay required and the
  TLS secret name was already conform.
- Additive outline.env block rendered through tpl with value/
  secretKeyRef/configMapKeyRef forms; chart-managed env stays in the
  template.

Major bump 3.1.1+up1.9.2 -> 4.0.0+up1.9.2 (runtime behavior changes
through hardening).

Part of #32

outline/templates/outline.ingress.yaml

@@ -1,13 +1,17 @@
+{{- if .Values.ingress.enabled }}
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: {{ .Release.Name }}-{{ .Chart.Name }}-ingress
   annotations:
-    cert-manager.io/cluster-issuer: {{ required "A Cluster-Issuer must be provided" .Values.ingress.clusterIssuer}}
+    cert-manager.io/cluster-issuer: {{ required "A Cluster-Issuer must be provided" .Values.ingress.clusterIssuer }}
     nginx.ingress.kubernetes.io/proxy-body-size: {{ .Values.ingress.maxUploadFileSize }}
     nginx.org/client-max-body-size: {{ .Values.ingress.maxUploadFileSize }}
+    {{- with .Values.ingress.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
 spec:
-  ingressClassName: nginx
+  ingressClassName: {{ .Values.ingress.className }}
   rules:
     - host: {{ required "A Domain/Host must be provided" .Values.ingress.domain }}
       http:
@@ -23,3 +27,4 @@ spec:
     - hosts:
         - {{ required "A Domain/Host must be provided" .Values.ingress.domain }}
       secretName: tls-{{ .Release.Name }}-{{ .Chart.Name }}-ingress
+{{- end }}