fix(ci): put outline's extraPorts entry where it belongs in the fixture

The previous commit appended the networkPolicy block in the middle of the
secrets: mapping, so dbSecretRef was absorbed into it. The chart's own
values.schema.json caught it immediately - "at '/networkPolicy': additional
properties 'dbSecretRef' not allowed" - which is exactly what issue #68 built
that schema for: a key the chart does not read is a named error at render time
instead of a silently missing secret.

Part of #5

ci/outline/test-values.yaml

@@ -1,6 +1,13 @@
 secrets:
   configSecretRef: op://ci/outline-config
   redisSecretRef: op://ci/outline-redis
+  dbSecretRef: op://ci/outline-db
+
+ingress:
+  domain: outline.ci.local
+  # clusterIssuer is strictly required (no default); the Ingress just has to
+  # apply - there is no cert-manager in the CI cluster.
+  clusterIssuer: ci
 
 # The egress cap of the chart's NetworkPolicy (Gitea #5) allows 443 for the
 # OIDC provider, because that is where an OIDC provider normally listens. The
@@ -18,10 +25,3 @@ networkPolicy:
   egress:
     extraPorts:
       - 5556
-  dbSecretRef: op://ci/outline-db
-
-ingress:
-  domain: outline.ci.local
-  # clusterIssuer is strictly required (no default); the Ingress just has to
-  # apply - there is no cert-manager in the CI cluster.
-  clusterIssuer: ci