…, customCA

Adds two layers of support for customers running the k8s-reporter behind
a TLS-inspecting proxy that requires a corporate CA bundle:

1. Generic escape hatch — extraVolumes, extraVolumeMounts, extraEnvVars
   following Bitnami / prometheus-community naming conventions.
2. customCA convenience wrapper — single config block that mounts the
   CA via subPath into /etc/ssl/certs/ so Go's stdlib picks it up
   additively alongside the system bundle (avoids the SSL_CERT_FILE
   footgun that would otherwise replace the system CAs).

The Kosli CLI is Go and uses net/http's default transport; no CLI
changes are needed because crypto/x509 reads /etc/ssl/certs/ automatically.

Refs #776

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…recation

Addresses parallel review feedback on PR #777:

- Add explicit defaultMode: 0644 to customCA Secret volume so the
  permission posture is self-documenting for auditors.
- Tighten the docs description of Go's cert-pool loading: it's two
  independent passes (cert file + dir scan), not one unified scan.
- Add the literal "x509: certificate signed by unknown authority"
  string to the docs section so customers searching the error message
  find it.
- Replace the SSL_CERT_FILE example in the extraEnvVars block with
  HTTPS_PROXY — SSL_CERT_FILE is the documented footgun and shouldn't
  be the first thing copy-pasters see.
- Shorten the customCA parent comment so the helm-docs values table
  reads cleanly; defer detail to the README section.
- Mark the existing `env:` map as DEPRECATED in favour of extraEnvVars
  to remove cross-reference confusion. Both still work.

Refs #776

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- Add `required` guard on customCA.key to prevent the silent
  empty-subPath footgun (an empty subPath causes K8s to mount the
  whole Secret as a directory at the mountPath, which would break Go
  trying to read it as a cert file).
- Tighten the env range loop with `{{- end }}` so the rendered env
  block doesn't carry a trailing blank line before extraEnvVars.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>

Picking up safe-to-fix nits regardless of strict scope:

- Quote customCA.secretName and subPath, matching the pattern used for
  cronSchedule and image fields. mbevc1 also asked for this.
- Quote $value in the env range so user-supplied values containing
  YAML special chars (colons, brackets) render safely.
- Tighten the podLabels range with `{{- end }}` for consistency with
  the env-range fix in commit b44df21. Pre-existing whitespace nit,
  not introduced by this PR, but cheap to fix while I'm here.
- Collapse the env: helm-docs comment to a single line so it reads
  cleanly in the rendered values table (the multi-line YAML example
  collapsed badly after helm-docs concatenation).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Same fix as the env value quoting in f2af5bf, applied to podLabels
for consistency. Also fixes the double-space typo (`:=  .Values.`)
in both range loops — harmless cosmetic carry-over from the original
template.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>