Align rallly chart with repo conventions (batch 3)

- Rename the Deployment (and its labels/selector/pod template/container)
  to {{ .Release.Name }}-{{ .Chart.Name }}-deployment per the naming
  scheme; the Service selector follows.
- Move the hardcoded pod/container security contexts into values
  (rallly.securityContext.pod / .container), defaults unchanged; the
  bogus null entry under capabilities.add becomes an empty list.
- Ingress standard: ingress.className value (default nginx) and
  ingress.annotations merged with the cert-manager annotation;
  domain/clusterIssuer stay required, TLS secret name already conformed.
- Add the tpl-rendered rallly.env value (value/secretKeyRef/
  configMapKeyRef forms), appended to the built-in env.
- Major bump 3.1.2+up4.12.3 -> 4.0.0+up4.12.3 (deployment rename
  replaces the Deployment on upgrade: selector is immutable).

rallly/values.yaml

@@ -23,6 +23,25 @@ rallly:
     pictureClaimPath: 'picture'
     emailClaimPath: 'email'
     nameClaimPath: 'name'
+  securityContext:
+    pod:
+      runAsNonRoot: true
+      runAsUser: 20000
+      runAsGroup: 1000
+      fsGroup: 1000
+      fsGroupChangePolicy: Always
+    container:
+      allowPrivilegeEscalation: false
+      readOnlyRootFilesystem: true
+      runAsNonRoot: true
+      capabilities:
+        drop:
+          - ALL
+        add: []
+  # Extra environment variables, appended to the ones the chart always sets.
+  # Values are rendered through tpl; value, secretKeyRef and configMapKeyRef
+  # forms are supported.
+  env: []
   resources:
     # Limits are optional: memory and ephemeral-storage limits default to
     # limitFactor x the request, an explicitly set limit always wins, and a
@@ -59,3 +78,7 @@ rallly:
 ingress:
   clusterIssuer: null
   domain: null
+  className: nginx
+  # Extra annotations for the Ingress; merged with the cert-manager
+  # cluster-issuer annotation the chart always sets.
+  annotations: {}