feat(linstor-scheduler): add optional admission webhook with configurable TLS - #94

…sion webhook (#3201)

## What this PR does

Re-vendors the `linstor-scheduler` chart from upstream **0.3.1**
(appVersion **v0.3.6**). Upstream now ships the admission webhook
natively (contributed via
[piraeusdatastore/helm-charts#94](piraeusdatastore/helm-charts#94)),
so the loose downstream admission templates — which round-tripped every
Pod through an old `k8s.io/api` and silently stripped fields they did
not know about, the `image` volume source and the native-sidecar
`restartPolicy` among them, breaking KubeVirt containerDisk VMs and
native sidecars cluster-wide — are dropped in favour of the upstream
copy.

- The admission webhook comes from the upstream chart now; the previous
downstream copy and its patch are removed. `make update` pulls 0.3.1 and
applies only `cozystack-scheduler-deployment.patch` (the scheduler pod
component label and the distro-suffix-stripped kube-scheduler image tag,
neither of which is upstream yet), so vendoring stays deterministic and
reproducible.
- The upstream admission Deployment keeps the same name but changes its
immutable pod selector, so an in-place upgrade of an existing install
would fail with `field is immutable`. Migration 52 deletes the old
admission Deployment before the upgrade so the new one is recreated
cleanly (`targetVersion` 52 → 53).
- appVersion v0.3.6 also carries the webhook's TLS certificate
hot-reload fix
([piraeusdatastore/linstor-scheduler-extender#22](piraeusdatastore/linstor-scheduler-extender#22)):
the webhook used to load its certificate once at startup, so after the
mounted Secret was rotated it kept serving a stale certificate and —
with `failurePolicy: Ignore` — silently stopped mutating until it was
restarted. It now reloads on rotation, so no external cert-reload
workaround is needed here.
- Wrapper values keep `replicaCount: 2`, now that the admission Pods
have their own PodDisruptionBudget and no longer share the scheduler's.
- Adds a helm-unittest suite covering the admission resources,
PodDisruptionBudget selector isolation, least-privilege RBAC, the TLS
provisioning modes and their rejection paths, the scheduler image-tag
strip, and backward compatibility with the webhook disabled.

Closes #3198.

### Screenshots

N/A — no UI changes.

### Downstream repositories

I walked the trigger map against the diff, file by file. It touches
`packages/system/linstor-scheduler/` and, under
`packages/core/platform/`, only migration 52 and the
`migrations.targetVersion` bump — an internal, release-managed counter,
not a user-facing `spec.components.platform.values.*` key documented on
the website. No trigger matches.

- [x] No downstream repository is affected by this change
- [ ] [cozystack/website](https://github.com/cozystack/website) -
follow-up:
- [ ]
[cozystack/terraform-provider-cozystack](https://github.com/cozystack/terraform-provider-cozystack)
- follow-up:
- [ ]
[cozystack/ansible-cozystack](https://github.com/cozystack/ansible-cozystack)
- follow-up:
- [ ] [cozystack/ccp](https://github.com/cozystack/ccp) - follow-up:
- [ ] [cozystack/talm](https://github.com/cozystack/talm) - follow-up:
- [ ] [cozystack/cozyhr](https://github.com/cozystack/cozyhr) -
follow-up:
- [ ] [cozystack/cozy-proxy](https://github.com/cozystack/cozy-proxy) -
follow-up:
- [ ]
[cozystack/cozystack-telemetry-server](https://github.com/cozystack/cozystack-telemetry-server)
- follow-up:
- [ ]
[cozystack/external-apps-example](https://github.com/cozystack/external-apps-example)
- follow-up:
- [ ] [cozystack/examples](https://github.com/cozystack/examples) -
follow-up:

### Release note

```release-note
fix(linstor-scheduler): the LINSTOR scheduler admission webhook no longer strips unknown Pod fields (the `image` volume source and native-sidecar `restartPolicy`), which had broken KubeVirt containerDisk VMs and native sidecars, and it now reloads its TLS certificate after rotation instead of silently failing. The chart is re-vendored from upstream 0.3.1; an automatic upgrade migration replaces the admission Deployment whose immutable selector changed.
```


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Expanded the optional Linstor Scheduler admission webhook with richer
configuration, including automated `schedulerName` mutation for LINSTOR
CSI-backed PVC Pods.
* **Improvements**
* Updated the Linstor Scheduler Helm chart to **0.3.1** (scheduler app
**v0.3.6**), including updated admission webhook behavior, safer
defaults, and **2 replicas**.
* Platform migrations now advance to **version 53**, with upgrade-safe
cleanup of the existing admission deployment.
* **Documentation**
* Updated Helm README and post-install notes with detailed guidance for
admission webhook and TLS modes.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->