Give the Trivy scan render values for freesailarr

ci/run-trivy-config.sh renders every changed chart before scanning it and exits
non-zero when the render fails - which it does for freesailarr, because the
chart is excluded from the install-test and therefore has no
ci/freesailarr/test-values.yaml to fall back on. The scan job would go red
without ever scanning anything.

The file supplies only the values the chart declares required (secret ref,
cluster issuer, the three media claims and one ingress host per app, since the
chart has no global ingress.domain) and nothing that would alter the security
posture the scan is meant to look at.

ci/trivy/values/freesailarr.yaml

@@ -0,0 +1,39 @@
+# Render values for the misconfiguration scan only (ci/run-trivy-config.sh).
+#
+# freesailarr has no ci/freesailarr/test-values.yaml because it is excluded from
+# the install-test (gluetun never becomes healthy without a real Wireguard key),
+# but it is still scanned - the chart runs nine containers with several
+# documented hardening deviations, which is exactly what the scan should see.
+#
+# Only the values the chart declares `required` - nothing that changes the
+# security posture (no securityContext, image, capability or resource overrides).
+# The ingress hosts are per app since the chart has no global ingress.domain.
+secrets:
+  gluetunSecretRef: op://Vault/scan/placeholder
+ingress:
+  clusterIssuer: letsencrypt
+media:
+  downloads:
+    existingClaim: scan-downloads
+  movies:
+    existingClaim: scan-movies
+  tv:
+    existingClaim: scan-tv
+qbittorrent:
+  ingress:
+    host: qbittorrent.scan.example.com
+prowlarr:
+  ingress:
+    host: prowlarr.scan.example.com
+radarr:
+  ingress:
+    host: radarr.scan.example.com
+sonarr:
+  ingress:
+    host: sonarr.scan.example.com
+seerr:
+  ingress:
+    host: seerr.scan.example.com
+bazarr:
+  ingress:
+    host: bazarr.scan.example.com