Add strict values.schema.json and null-safe hardening to urlaubsverwaltung

Two changes, both about values that do not do what they promise:

1. values.schema.json (#68): additionalProperties: false on every
   chart-owned object level, so a key the chart does not read is rejected
   at render time instead of being silently ignored.

2. Null-safety for hardening, probes and resources (#99): an override
   written without children is YAML null and replaced the whole default
   sub-tree, rendering "securityContext: null" (unhardened container), a
   vanished probe or a container without resource accounting - silently.
   The defaultedDict helper from #96 is adopted so an empty block means
   "chart defaults apply", while an explicitly set value still wins,
   including false and 0.

The schema types allow null for exactly these blocks, so the two changes
agree instead of the schema rejecting what the helper is meant to absorb.

No ingress gate here: this chart already gates its Ingress correctly.

Rendering with normal values is byte-identical to the previous version.

Major bump: a schema can break existing deployments that carry dead keys.

urlaubsverwaltung/templates/urlaubsverwaltung.deployment.yaml

@@ -17,13 +17,13 @@ spec:
     spec:
       automountServiceAccountToken: false
       securityContext:
-        {{- toYaml .Values.urlaubsverwaltung.securityContext.pod | nindent 8 }}
+        {{- include "urlaubsverwaltung.podSecurityContext" .Values.urlaubsverwaltung.securityContext | nindent 8 }}
       containers:
         - name: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
           image: "urlaubsverwaltung/urlaubsverwaltung:{{ .Chart.AppVersion }}"
           imagePullPolicy: IfNotPresent
           securityContext:
-            {{- toYaml .Values.urlaubsverwaltung.securityContext.container | nindent 12 }}
+            {{- include "urlaubsverwaltung.containerSecurityContext" .Values.urlaubsverwaltung.securityContext | nindent 12 }}
           volumeMounts:
             # The JVM (Tomcat work dir, temp files) needs a writable /tmp with
             # a read-only root filesystem.
@@ -130,13 +130,13 @@ spec:
             {{- end }}
             {{- end }}
           resources:
-            {{- include "urlaubsverwaltung.resources" .Values.urlaubsverwaltung.resources | nindent 12 }}
+            {{- include "urlaubsverwaltung.effectiveResources" .Values.urlaubsverwaltung.resources | nindent 12 }}
           livenessProbe:
-            {{- toYaml .Values.urlaubsverwaltung.livenessProbe | nindent 12 }}
+            {{- include "urlaubsverwaltung.livenessProbe" .Values.urlaubsverwaltung.livenessProbe | nindent 12 }}
           readinessProbe:
-            {{- toYaml .Values.urlaubsverwaltung.readinessProbe | nindent 12 }}
+            {{- include "urlaubsverwaltung.readinessProbe" .Values.urlaubsverwaltung.readinessProbe | nindent 12 }}
           startupProbe:
-            {{- toYaml .Values.urlaubsverwaltung.startupProbe | nindent 12 }}
+            {{- include "urlaubsverwaltung.startupProbe" .Values.urlaubsverwaltung.startupProbe | nindent 12 }}
       volumes:
         - name: tmp
           emptyDir: {}