Paperless-ngx chart: naming scheme, secret refs, pinned init images (conventions batch 3)

Batch-3 major PR for paperless-ngx (issue #32):

- secrets.redisRef/databaseRef/paperlessRef -> redisSecretRef/
  databaseSecretRef/paperlessSecretRef (consistent with the other
  SecretRef values in the same block); CI fixtures updated
- TLS secret renamed to the standard tls-<release>-<chart>-ingress
  (domain no longer part of the name)
- busybox init/cronjob image pinned via paperless.busybox.image
  values, default bumped 1.28 -> 1.38.0
- probes values-configurable (defaults unchanged, incl. the 600s
  startup budget); consume CronJob deliberately stays probe-less
- ingress standard: ingress.className (default nginx) and
  ingress.annotations merge; domain/clusterIssuer stay required
- additive paperless.env block rendered through tpl (value,
  secretKeyRef, configMapKeyRef forms)
- disabled scripts ConfigMap renamed to ...-configmap; PVC names kept
  as documented naming-scheme exception (comments in the templates)
- chart 8.0.1+up3.0.5 -> 9.0.0+up3.0.5 (breaking values changes)

paperless-ngx/templates/paperless.ingress.yaml

@@ -3,11 +3,14 @@ kind: Ingress
 metadata:
   name: {{ .Release.Name }}-{{ .Chart.Name }}-ingress
   annotations:
-    cert-manager.io/cluster-issuer: {{ required "A Cluster-Issuer must be provided" .Values.ingress.clusterIssuer}}
+    cert-manager.io/cluster-issuer: {{ required "A Cluster-Issuer must be provided" .Values.ingress.clusterIssuer }}
     nginx.ingress.kubernetes.io/proxy-body-size: {{ .Values.paperless.files.maxUploadFileSize }}
     nginx.org/client-max-body-size: {{ .Values.paperless.files.maxUploadFileSize }}
+    {{- with .Values.ingress.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
 spec:
-  ingressClassName: nginx
+  ingressClassName: {{ .Values.ingress.className }}
   rules:
     - host: {{ required "A Domain/Host must be provided" .Values.ingress.domain }}
       http:
@@ -22,4 +25,4 @@ spec:
   tls:
     - hosts:
         - {{ required "A Domain/Host must be provided" .Values.ingress.domain }}
-      secretName: tls-{{ .Release.Name }}-{{ .Chart.Name }}-{{ .Values.ingress.domain }}-ingress
+      secretName: tls-{{ .Release.Name }}-{{ .Chart.Name }}-ingress