Helm chart: support custom pod labels

[damoun]

Describe the feature

Let users add labels to the pods the chart creates, globally and per workload, the same way podAnnotations works today:

podLabels: {} # every pod the chart creates
web:
  podLabels: {}
worker:
  podLabels: {}
migrations:
  job:
    podLabels: {}
pipelock:
  podLabels: {}

Why is this feature important?

Network policies select pods by label. A common setup only lets the ingress or gateway reach pods with a specific label, or scopes egress per component. The chart exposes podAnnotations but not labels, so the only way in is a post-render patch on the Deployment. That's fragile, and most Helm users don't know about it.

It's opt-in and leaves the defaults unchanged.

Additional context, screenshots, and relevant links

• Not on main yet. I checked charts/sure/values.yaml and templates/web-deployment.yaml.
• The labels would go after the selector labels, so they can't break matchLabels, and per-workload values would win over the global ones:

  template:
    metadata:
      labels:
        app.kubernetes.io/component: web
        {{- include "sure.selectorLabels" . | nindent 8 }}
        {{- with (merge (deepCopy .Values.web.podLabels) .Values.podLabels) }}
        {{- toYaml . | nindent 8 }}
        {{- end }}

• My current workaround on chart 0.7.6 is a Flux postRenderers patch that adds a label to sure-web.

I'm happy to open a PR if the shape looks right.