outline: strict values.schema.json and null-safe hardening

No ingress gate: this chart already gates its Ingress correctly. Two
changes plus one guard the existing gate turned out to need.

1. values.schema.json (#68): additionalProperties: false on every
   chart-owned object level.

2. Null-safety for hardening, probes and resources (#99). All three
   probes keep /_health when rebuilt: it is Outline's only health
   endpoint, and "/" returns 500 as well when the database is down, so
   there is no dependency-free path to fall back to.

3. ingress.domain is required() where the StatefulSet reads it. It feeds
   the URL env var - Outline's public URL for generated links and the
   OIDC redirect URI - and did so without a guard. With the existing gate
   and no domain it rendered "https://", breaking logins silently. That
   hole predates this change; it now fails loudly.

outline.storage stays deliberately not null-safe: an erased block yields
an invalid PVC, which is the loud class #99 excludes.

Apart from an added comment, the rendered manifest is unchanged.

outline/templates/outline.sfs.yaml

@@ -18,7 +18,7 @@ spec:
     spec:
       automountServiceAccountToken: false
       securityContext:
-        {{- toYaml .Values.outline.securityContext.pod | nindent 8 }}
+        {{- include "outline.podSecurityContext" .Values.outline.securityContext | nindent 8 }}
       containers:
         - name: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
           image: "outlinewiki/outline:{{ .Chart.AppVersion }}"
@@ -26,8 +26,12 @@ spec:
           env:
             - name: PORT
               value: "3000"
+            # ingress.domain is not a pure Ingress value: it is also Outline's
+            # public URL, used for generated links and the OIDC redirect URI,
+            # so it stays required even when the Ingress is switched off (an
+            # empty value would render "https://" and break logins silently).
             - name: URL
-              value: "https://{{ .Values.ingress.domain }}"
+              value: "https://{{ required "A Domain/Host must be provided (ingress.domain)" .Values.ingress.domain }}"
             - name: SECRET_KEY
               valueFrom:
                 secretKeyRef:
@@ -100,15 +104,15 @@ spec:
               protocol: TCP
               name: http
           livenessProbe:
-            {{- toYaml .Values.outline.livenessProbe | nindent 12 }}
+            {{- include "outline.livenessProbe" .Values.outline.livenessProbe | nindent 12 }}
           readinessProbe:
-            {{- toYaml .Values.outline.readinessProbe | nindent 12 }}
+            {{- include "outline.readinessProbe" .Values.outline.readinessProbe | nindent 12 }}
           startupProbe:
-            {{- toYaml .Values.outline.startupProbe | nindent 12 }}
+            {{- include "outline.startupProbe" .Values.outline.startupProbe | nindent 12 }}
           resources:
-            {{- include "outline.resources" .Values.outline.resources | nindent 12 }}
+            {{- include "outline.effectiveResources" .Values.outline.resources | nindent 12 }}
           securityContext:
-            {{- toYaml .Values.outline.securityContext.container | nindent 12 }}
+            {{- include "outline.containerSecurityContext" .Values.outline.securityContext | nindent 12 }}
           volumeMounts:
             - mountPath: "/outline-data/data"
               name: outline-data