feat: surface the authn service-certificate renewal knobs as values

[EdmondDantes21]

Companion to krateoplatformops/authn#76, which adds background renewal of authn's own authn-clientconfig certificate.

Neither change is required for the fix to work. .Values.env is a free-form map rendered into the ConfigMap, so the three new variables were already settable, and they need no new RBAC (the validity annotations are written with the get+update on secrets the Role already grants). This PR is about making them discoverable and validated.

chart/values.yaml — surface the knobs

• AUTHN_SERVICE_CRT_EXPIRES_IN: "8760h" — duration requested for authn's own certificate; previously hardcoded in main.go.
• AUTHN_CRT_RENEWAL_THRESHOLD: "0.66" — fraction of the granted lifetime after which it is re-issued.
• AUTHN_CRT_RENEWAL_ENABLED: "true" — escape hatch back to the pre-renewal behaviour.

All three defaults match the binary's own, so rendering is behaviourally unchanged — the ConfigMap simply gains three keys whose values the process would have used anyway.

chart/values.schema.json — new

The chart had no schema. This one types every key of values.yaml, documents the certificate knobs, and is additionalProperties: false at the top level so typos are caught rather than silently ignored.

Three things it must tolerate, each of which a naive strict schema gets wrong and each found by testing against a real install rather than by reading values.yaml:

• service.nodePort is set by real installs but is not declared in values.yaml. Added explicitly.
• env values may be null (installs null AUTHN_KUBECONFIG_SERVER_URL to fall back to the in-cluster URL), so env entries are ["string","null"] and unlisted variables are permitted.
• authn-crd and global are injected by Helm for subchart value passing, so a top-level additionalProperties: false rejects every install without them.

Free-form blocks (podSecurityContext, securityContext, resources, probes, affinity, nodeSelector, volumes, tolerations) are deliberately left open so arbitrary Kubernetes fields still pass.

Verified with helm template — passing: chart defaults, the real install's values (nodePort + null env), an explicit dev image override, the new knobs set explicitly, an arbitrary extra env var, and service.type=LoadBalancer. Correctly rejected: replicaCount as a string, a bogus image.pullPolicy, a bogus service.type, and a typo'd top-level key.

crd-chart is untouched — its values.yaml is empty, so it has nothing to validate.