Paperless-ngx chart: naming scheme, secret refs, pinned init images (conventions batch 3)

Batch-3 major PR for paperless-ngx (issue #32):

- secrets.redisRef/databaseRef/paperlessRef -> redisSecretRef/
  databaseSecretRef/paperlessSecretRef (consistent with the other
  SecretRef values in the same block); CI fixtures updated
- TLS secret renamed to the standard tls-<release>-<chart>-ingress
  (domain no longer part of the name)
- busybox init/cronjob image pinned via paperless.busybox.image
  values, default bumped 1.28 -> 1.38.0
- probes values-configurable (defaults unchanged, incl. the 600s
  startup budget); consume CronJob deliberately stays probe-less
- ingress standard: ingress.className (default nginx) and
  ingress.annotations merge; domain/clusterIssuer stay required
- additive paperless.env block rendered through tpl (value,
  secretKeyRef, configMapKeyRef forms)
- disabled scripts ConfigMap renamed to ...-configmap; PVC names kept
  as documented naming-scheme exception (comments in the templates)
- chart 8.0.1+up3.0.5 -> 9.0.0+up3.0.5 (breaking values changes)

ci/paperless-ngx/test-values.yaml

@@ -1,7 +1,7 @@
 secrets:
-  redisRef: op://ci/paperless-redis
-  databaseRef: op://ci/paperless-db
-  paperlessRef: op://ci/paperless
+  redisSecretRef: op://ci/paperless-redis
+  databaseSecretRef: op://ci/paperless-db
+  paperlessSecretRef: op://ci/paperless
 
 ingress:
   domain: paperless.ci.local