VoucherVault chart: complete security hardening, flexible ingress

Enable readOnlyRootFilesystem and drop all capabilities by default. The
paths the image writes at runtime are covered by emptyDirs (/tmp,
/opt/app/logs and STATIC_ROOT /opt/app/myapp/static); an init container
seeds the static volume with the assets shipped in the image because the
directory doubles as the app's static source. The ephemeral-storage
request covers the ~90Mi static emptyDir.

Move the Ingress to the repo-standard flexible style: ingress.className
value (default nginx) instead of a hardcoded ingressClassName, and
ingress.annotations merged with the cert-manager annotation. domain and
clusterIssuer stay required; the TLS secret name was already standard.

Major bump 3.1.2+up1.30.1 -> 4.0.0+up1.30.1 (hardening changes runtime
behavior). App version unchanged. Part of #32.

voucher-vault/Chart.yaml

@@ -5,7 +5,7 @@ icon: https://raw.githubusercontent.com/l4rm4nd/VoucherVault/main/myapp/static/a
 
 type: application
 
-version: 3.1.2+up1.30.1
+version: 4.0.0+up1.30.1
 appVersion: "1.30.1"
 
 maintainers: