gotenberg: null-safe hardening, probes and resources

Retrofit of #99 for a chart that already carries a values.schema.json,
plus the schema type change that goes with it.

An override written without children is YAML null. Where the chart
defines a default, Helm's coalescing deletes the default before schema
validation runs, so the schema never sees the null and cannot reject it:
the container rendered "securityContext: null" - unhardened, healthy,
silent. Where the chart defines no default (resources.limits), the null
survives into validation and a strict "object" type aborted the render.

The defaultedDict helper from #96 handles the first case; widening the
types of exactly these blocks to ["object", "null"] handles the second.
All other keys stay strict, additionalProperties: false is untouched.

The probes address the container port by name, so a rebuilt default probe
needs no further context.

Rendering with normal values is byte-identical to 5.0.0.

gotenberg/templates/NOTES.txt

@@ -1,5 +1,8 @@
 {{- $replicas := include "gotenberg.replicas" (dict "scaleDown" .Values.scaleDown "replicas" .Values.gotenberg.replicas) -}}
-{{- $limits := (include "gotenberg.resources" .Values.gotenberg.resources | fromYaml).limits | default dict -}}
+{{- /* effectiveResources, not resources: an erased "resources:" block falls back
+       to the chart defaults in the Deployment (#99), so the notes must report the
+       limits the release actually gets, not "(none set)". */ -}}
+{{- $limits := (include "gotenberg.effectiveResources" .Values.gotenberg.resources | fromYaml).limits | default dict -}}
 {{- $svc := printf "%s-%s-service" .Release.Name .Chart.Name -}}
 Gotenberg {{ .Chart.AppVersion }} — release {{ .Release.Name }} in namespace {{ .Release.Namespace }}.