apache-tika: null-safe hardening, probes and resources

Retrofit of #99 for a chart that already carries a values.schema.json,
plus the schema type change that goes with it.

An override written without children is YAML null. Where the chart
defines a default, Helm's coalescing deletes the default before schema
validation runs, so the schema never sees the null and cannot reject it:
the container rendered "securityContext: null" - unhardened, healthy,
silent. Where the chart defines no default (resources.limits), the null
survives into validation and a strict "object" type aborted the render.

The defaultedDict helper from #96 handles the first case; widening the
types of exactly these blocks to ["object", "null"] handles the second.
All other keys stay strict, additionalProperties: false is untouched.

The probes address the container port by name, so a rebuilt default probe
needs no further context.

Rendering with normal values is byte-identical to 8.0.0.

apache-tika/templates/apache-tika.deployment.yaml

@@ -17,7 +17,7 @@ spec:
     spec:
       automountServiceAccountToken: false
       securityContext:
-        {{- toYaml .Values.tika.securityContext.pod | nindent 8 }}
+        {{- include "apache-tika.podSecurityContext" .Values.tika.securityContext | nindent 8 }}
       containers:
         - name: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
           image: "apache/tika:{{ .Chart.AppVersion }}"
@@ -46,7 +46,7 @@ spec:
             {{- end }}
           {{- end }}
           securityContext:
-            {{- toYaml .Values.tika.securityContext.container | nindent 12 }}
+            {{- include "apache-tika.containerSecurityContext" .Values.tika.securityContext | nindent 12 }}
           volumeMounts:
             # Tika writes temporary files during parsing; with a read-only
             # root filesystem /tmp must be a writable emptyDir.
@@ -57,13 +57,13 @@ spec:
               protocol: TCP
               name: tika-port
           livenessProbe:
-            {{- toYaml .Values.tika.livenessProbe | nindent 12 }}
+            {{- include "apache-tika.livenessProbe" .Values.tika.livenessProbe | nindent 12 }}
           readinessProbe:
-            {{- toYaml .Values.tika.readinessProbe | nindent 12 }}
+            {{- include "apache-tika.readinessProbe" .Values.tika.readinessProbe | nindent 12 }}
           startupProbe:
-            {{- toYaml .Values.tika.startupProbe | nindent 12 }}
+            {{- include "apache-tika.startupProbe" .Values.tika.startupProbe | nindent 12 }}
           resources:
-            {{- include "apache-tika.resources" .Values.tika.resources | nindent 12 }}
+            {{- include "apache-tika.effectiveResources" .Values.tika.resources | nindent 12 }}
       volumes:
         - name: tmp
           emptyDir: {}