[Backport release-1.6] fix(cozy-lib): make the cozyconfig helpers survive uninjected values - #5141

`_cluster` and `_namespace` reach a chart through valuesFrom on the
cozystack-values Secret, so they are absent whenever a chart is rendered
on its own: `helm lint`, a plain `helm template`, and any helm-unittest
suite that does not set them. Twelve of the helpers in _cozyconfig.tpl
read straight through the missing map and abort the render rather than
returning their documented empty default.

Two spellings, one cause. `index .Values._cluster "root-host"` raises
`index of untyped nil`, and `.Values._namespace.host` raises
`nil pointer evaluating interface {}.host`. In both cases the trailing
`| default ""` never runs: it applies to the result, and there is no
result, only an error. That default covered a key missing from a map
that exists, never a missing map.

Guard the map instead, which is what `cozy-lib.images-registry` in this
same file already did:

    (index (.Values._cluster | default dict) "root-host") | default ""

`index` on an empty map returns nil harmlessly, so the trailing default
applies as it always read. With the map present, `| default dict`
returns it untouched.

This changes no rendered output. Every one of the 34 charts that symlink
cozy-lib was rendered before and after, both with the injected values
populated and with them set to empty maps, and every result is
byte-identical. Eight charts differ between any two runs because they
generate passwords; rendering the unchanged tree twice reproduces
exactly those eight, which is how they are excluded.

What this does not do is fix a chart that fails today. The charts that
cannot render standalone read the injected values directly in their own
templates rather than through these helpers, so they are unaffected by a
change to the library and are being addressed where they live.

Twelve of the thirteen helpers here have no callers anywhere in
packages/ at present; only `cozy-lib.images-registry` is reached, from
`cozy-lib.image`, and it was already guarded. The guard is still worth
having on the rest: they are the library's public surface, they are what
a chart author copies when reaching for cluster configuration, and the
broken spelling propagates by being read. `cozy-lib.image` is called
from four templates, so these helpers do get adopted once they exist.

Add a suite in cozy-lib-tests, which is where library behaviour is
pinned because a library chart renders nothing of its own. One case
covers the uninjected state, which needs no mocking since neither key is
in values.yaml, and one covers the injected state so the guard cannot
quietly change what a populated map returns. The injected case includes
`scheduling` and `branding` specifically: those two are the helpers
whose body was restructured rather than wrapped, so they are the ones
whose present-map behaviour most needs pinning. Against the unguarded
helpers the first case fails with `index of untyped nil`.

(cherry picked from commit 93ffb38)

On release-1.6 one of these helpers does have a caller that fails
today, so the two paragraphs above about callers do not hold here:
tenant.ciliumPolicies calls cozy-lib.bundle-name since the isp-hosted
Cilium guard was backported in 2f820f7. Every tenant suite that
renders templates/networkpolicy.yaml without setting _cluster aborts
with `index of untyped nil` in the helper, which is how the
vm-exportproxy suite has failed on this branch since then. With the map
guarded, bundle-name returns "" there and the policies render as on
every non-isp-hosted bundle. The patch applies unchanged.

Assisted-by: LLM
Signed-off-by: Myasnikov Daniil <[email protected]>