feat: generate only authn's RSA private key, not a shared JWT secret

[EdmondDantes21]

Summary

authn now signs RS256 JWTs with an RSA private key and publishes the public key itself via JWKS (GET /.well-known/jwks.json). chart/templates/secret.yaml now generates only the private key — Secret authn-jwt-signing-key, key private.pem, matching the authn chart's jwt.signKeySecretName/jwt.signKeySecretKey defaults — replacing the old shared jwt-sign-key HMAC secret. lookup still reuses an existing key across re-renders so reconciles never rotate it.

A second Secret holding the public key is deliberately NOT created: it would be one more object to keep in sync, and would pin verifiers to a keypair only a redeploy of all of them could rotate. Verifiers (snowplow) fetch the public key from authn's JWKS endpoint instead.

chart/values.schema.json updates the authn/snowplow sub-schemas' JWT config shape to match their new chart values (jwt.{signKeySecretName,signKeySecretKey,mountPath,kid} for authn; jwt.{jwksUrl,cacheTTL,minRefreshInterval,requestTimeout} for snowplow).

chart/files/component-pins.yaml already pins authn: 0.26.2 / snowplow: 1.9.3 on main (pre-staged for this migration) — no version-pin change needed here, those charts just need to actually exist at those versions before this can be installed end-to-end.

Cross-repo dependency — full chain

1. feat(jwtutil): RS256 signing + JWKS-based key resolution plumbing#21
2. feat: sign JWTs with RS256, publish public key via JWKS authn#20 (depends on 1)
3. feat: verify JWTs against authn's JWKS instead of a shared signing key snowplow#146 (depends on 1, pairs with 2)
4. This PR — safe to merge any time (it only changes secret shape + schema docs), but a helm install only succeeds end-to-end once authn 0.26.2 and snowplow 1.9.3 are actually published to the chart OCI registry, i.e. after 2 and 3 are tagged.

Test plan

• helm lint chart/ (with the CHART_VERSION/APP_VERSION placeholders substituted, as release-oci.yaml does) — no errors attributable to this change
• Full helm install end-to-end once authn/snowplow charts at the pinned versions are published