Zipline chart: ingress standard, secret ref structure (conventions batch 3)

Repo-standard flexible ingress (required clusterIssuer instead of the
hardcoded letsencrypt-issuer, domain moved from config.domain to
ingress.domain, className value, annotations merge, standard TLS secret
name), secrets.<name>SecretRef structure, core secret renamed to the
standard -secret name, additive tpl-rendered env block, documented PVC
naming exception. Major bump 4.1.2+up4.7.0 -> 5.0.0+up4.7.0.

ci/zipline/fixtures.yaml

@@ -10,7 +10,7 @@ stringData:
 apiVersion: v1
 kind: Secret
 metadata:
-  name: ci-zipline-core-secret
+  name: ci-zipline-secret
 stringData:
   server-secret: zipline-ci-core-secret-0123456789abcdef0123456789abcdef0123456789
 ---

ci/zipline/test-values.yaml

@@ -1,9 +1,11 @@
 config:
   storage: 1Gi
   storageClass: local-path
+ingress:
   domain: zipline.ci.local
-  # The OnePasswordItem CRs only need non-null item paths; the actual
-  # Kubernetes Secrets come from ci/zipline/fixtures.yaml.
-  secretRef:
-    db: op://ci/zipline-db
-    zipline: op://ci/zipline-core
+  clusterIssuer: ci-issuer
+# The OnePasswordItem CRs only need non-null item paths; the actual
+# Kubernetes Secrets come from ci/zipline/fixtures.yaml.
+secrets:
+  databaseSecretRef: op://ci/zipline-db
+  ziplineSecretRef: op://ci/zipline-core