Correct two firewall claims the runtime test disproved

FIREWALL_INPUT_PORTS does not open the app ports inside a pod network. gluetun
detects the pod's own subnet and inserts an INPUT accept for it ahead of the
per-port rules, and every packet arriving at the pod IP matches that rule by
destination. Measured with the packet counters: 50 fresh requests moved the
subnet rule from 306 to 356 packets while every --dport rule stayed at 0 since
container start. A port that listens but is not in the list (gluetun's control
server on 8000) is reachable from another pod all the same.

The variable is kept - it is the explicit statement of which ports are meant to
be reachable, and the subnet detection is gluetun's behaviour rather than a
guarantee of this chart - but the comments no longer claim the traffic would be
dropped without it.

Second correction, same run: the /tmp/gluetun emptyDir fixed the "open ...
permission denied" failure, but gluetun also chowns the file, which needs
CAP_CHOWN. With all capabilities but NET_ADMIN dropped that logs "chown
/tmp/gluetun/ip: operation not permitted" on every VPN restart. The file is
written and the public IP is persisted, so this is a log line rather than a
failure, and granting CHOWN to silence it would widen the container's
capabilities for nothing. Noted where the mount is declared.

freesailarr/templates/_helpers.tpl

@@ -197,8 +197,18 @@ ingress block with enabled: true. Used by the ingress template.
 {{/*
 Comma-separated FIREWALL_INPUT_PORTS for gluetun: the ports of the enabled app
 containers (ingress traffic and the kubelet probes both arrive on the pod IP)
-plus 9999 for gluetun's own health server. Without these the gluetun firewall
-drops the traffic.
+plus 9999 for gluetun's own health server.
+
+Measured caveat: inside a pod network these rules never actually match. gluetun
+detects the pod's own subnet and inserts
+"-A INPUT -d <pod-subnet> -i eth0 -j ACCEPT" ahead of the per-port rules, and
+every packet arriving at the pod IP matches it by destination - the packet
+counters on the --dport rules stayed at 0 while the subnet rule absorbed the
+traffic. The declaration is kept as an explicit statement of which ports are
+meant to be reachable, and because that subnet detection is gluetun's, not a
+guarantee of the chart's: a CNI that hands out a /32 or a future gluetun that
+drops the rule would make these the only thing keeping probes and ingress
+alive. It is not what opens the ports today.
 */}}
 {{- define "freesailarr.firewallInputPorts" -}}
 {{- $ports := list -}}