calibre-web-automated: strict schema, ingress gate and null-safe hardening

Three changes, all about values that do not do what they promise:

1. values.schema.json (#68): additionalProperties: false on every
   chart-owned object level.

2. Ingress gate (#93): the Ingress template is wrapped in
   {{- if .Values.ingress.enabled }} and the key is added to values.yaml
   with default true, so behaviour is unchanged.

   The domain checkpoint from rallly ran over values.yaml and templates
   and came back empty here: ingress.domain is read nowhere but in the
   Ingress template. Unlike rallly, zipline, voucher-vault and outline,
   this gate therefore frees both domain and clusterIssuer, and no extra
   required() is needed.

3. Null-safety for hardening, probes and resources (#99).

   This chart's hardening is a documented deviation from the repo
   standard, and the fallbacks reproduce it exactly instead of restoring
   the standard: no runAs* values (s6-overlay boots as root and drops to
   PUID/PGID 1000), readOnlyRootFilesystem stays false (read-only mode
   disables the PUID/PGID remapping, silently moving the runtime uid from
   1000 to 911 and breaking existing volume data), and capabilities.add
   keeps its six entries that the s6 init and supervision need. A
   "cleaned up" standard default here would not be tidier, it would be an
   outage.

cwa.storage stays deliberately not null-safe: an erased value yields an
invalid PVC, which is the loud class #99 excludes.

Rendering with normal values is byte-identical to 4.0.0.

calibre-web-automated/templates/calibre-web-automated.sfs.yaml

@@ -18,7 +18,7 @@ spec:
     spec:
       automountServiceAccountToken: false
       securityContext:
-        {{- toYaml .Values.cwa.securityContext.pod | nindent 8 }}
+        {{- include "calibre-web-automated.podSecurityContext" .Values.cwa.securityContext | nindent 8 }}
       containers:
         - name: {{ .Release.Name }}-{{ .Chart.Name }}-container
           image: "ghcr.io/crocodilestick/calibre-web-automated:{{ .Chart.AppVersion }}"
@@ -79,15 +79,15 @@ spec:
             - mountPath: "/cwa-book-ingest"
               name: cwa-consume
           livenessProbe:
-            {{- toYaml .Values.cwa.livenessProbe | nindent 12 }}
+            {{- include "calibre-web-automated.livenessProbe" .Values.cwa.livenessProbe | nindent 12 }}
           readinessProbe:
-            {{- toYaml .Values.cwa.readinessProbe | nindent 12 }}
+            {{- include "calibre-web-automated.readinessProbe" .Values.cwa.readinessProbe | nindent 12 }}
           startupProbe:
-            {{- toYaml .Values.cwa.startupProbe | nindent 12 }}
+            {{- include "calibre-web-automated.startupProbe" .Values.cwa.startupProbe | nindent 12 }}
           resources:
-            {{- include "calibre-web-automated.resources" .Values.cwa.resources | nindent 12 }}
+            {{- include "calibre-web-automated.effectiveResources" .Values.cwa.resources | nindent 12 }}
           securityContext:
-            {{- toYaml .Values.cwa.securityContext.container | nindent 12 }}
+            {{- include "calibre-web-automated.containerSecurityContext" .Values.cwa.securityContext | nindent 12 }}
       restartPolicy: Always
       volumes:
         # Deliberate naming exception (see README): both PVCs keep their