feat(chart): add extraManifests and backend.environmentSecrets

[oba11]

Closes #120

Summary

• Add backend.environmentSecrets — list of env vars sourced from existing Secrets via secretKeyRef, rendered into the backend container's env:.
• Add top-level extraManifests — list of raw, templated manifests rendered as additional documents (tpl . $), so chart helpers like {{ include "artifact-keeper.fullname" . }} work inside entries.
• Motivating use case: deliver OTEL_EXPORTER_OTLP_HEADERS securely by shipping an ExternalSecret via extraManifests and injecting its value via backend.environmentSecrets — no plaintext in values, no second Argo Application.

Test plan

• helm lint charts/artifact-keeper passes.
• helm template with both new values set renders the expected secretKeyRef entry under the backend container's env: and emits the extra manifest as its own document.
• Defaults (environmentSecrets: [], extraManifests: []) produce no diff vs. main when unset.

[oba11]

Hey @brandonrc — quick ping when you have a moment 🙏

All required checks are green. The only red is SonarCloud Scan, which fails because SONAR_TOKEN isn't exposed to fork PRs.

Happy to tweak anything else. Thanks!

[brandonrc]

Thanks for the PR. The one required check failing here is Verify helm-docs output: the chart README needs regenerating after the values change. Could you run this from the repo root and commit the result?

cd charts/artifact-keeper && helm-docs

(helm-docs v1.14.2, matching .github/workflows/helm-docs.yml.) That should clear the check.

Heads up: the red SonarCloud Scan is a known non-blocking issue on fork PRs. GitHub withholds SONAR_TOKEN from forks and the job is already continue-on-error, so it is safe to ignore.

[oba11]

Thanks @brandonrc, I've regenerated the chart README and all good now.

[oba11]

@brandonrc just want to check again on the merge-ability of this pull request. Thanks alot for your help