feat(step-issuer): add extraInitContainers and extraContainers support

[vishalud]

Description

Add extraInitContainers and extraContainers to the step-issuer chart values, allowing users to inject sidecar and init containers into the controller Deployment.

This is a natural companion to the passwordFile/passwordEnv feature added in step-issuer v0.11.0 (PR #365). Users who manage secrets with tools like HashiCorp Vault Agent need a way to inject the agent container that renders the password file into the pod. Without this, the only options are a kustomize post-render patch or the Vault Agent Injector webhook (which not all platforms run).

Usage example

extraInitContainers:
  - name: vault-agent-init
    image: vault:1.15
    env:
      - name: VAULT_ADDR
        value: https://vault.example.com
    volumeMounts:
      - name: vault-home
        mountPath: /home/vault

volumes:
  - name: vault-home
    emptyDir:
      medium: Memory

volumeMounts:
  - name: vault-home
    mountPath: /home/vault

Then in the StepIssuer CR:

provisioner:
  passwordFile: /home/vault/secrets/provisioner-password

Changes

• values.yaml: Added extraInitContainers: [] and extraContainers: []
• templates/deployment.yaml: Render both in the pod spec when provided

Tested with helm template — renders correctly with and without values set.

[CLAassistant]

All committers have signed the CLA.