Samba chart: security hardening, configurable node ports, values cleanup

- Add securityContext.pod/container values with hardened defaults; the
  dockur/samba image requires root and a writable root filesystem, so the
  remaining deviations from the baseline are documented in values.yaml
  (caps reduced to CHOWN, DAC_OVERRIDE, FOWNER, NET_BIND_SERVICE, SETGID,
  SETUID; allowPrivilegeEscalation: false)
- Make the NodePorts configurable (samba.smbNodePort/netbiosNodePort,
  defaults 30445/30139 as published before)
- Rename secrets.sambaUsersRef to secrets.sambaUsersSecretRef (breaking)
- Rename the ConfigMap from -config-cfm to -configmap
- Add the tpl-rendered env value convention (value, secretKeyRef,
  configMapKeyRef forms)
- Fix the CI users.conf fixture to the username:uid:groupname:gid:password
  format the pinned image actually parses
- Bump chart to 4.0.0+up4.23.10

Part of #32

ci/samba/fixtures.yaml

@@ -1,10 +1,10 @@
 # Fixtures for the samba install-test: the users secret the 1Password
 # operator would otherwise materialize (release name: ci). users.conf uses
-# the dockur/samba "user:password" format.
+# the dockur/samba "username:uid:groupname:gid:password[:homedir]" format.
 apiVersion: v1
 kind: Secret
 metadata:
   name: ci-samba-users-secret
 stringData:
   users.conf: |
-    ciuser:ci-password
+    ciuser:1000:smb:1000:ci-password

ci/samba/test-values.yaml

@@ -1,5 +1,5 @@
 secrets:
-  sambaUsersRef: op://ci/samba-users
+  sambaUsersSecretRef: op://ci/samba-users
 
 samba:
   storageClass: local-path