Add official Helm chart for nuts-admin

[reinkrul]

Summary

• Adds charts/nuts-admin: a Helm chart with Deployment, Service, ConfigMap (rendering config.yaml), optional Ingress, and NUTS_NODE_ADDRESS/NUTS_CONFIGFILE env wiring.
• Adds .github/workflows/helm-chart-release.yaml: publishes the chart as an OCI artifact to ghcr.io on push to main when charts/ changes, same pattern as nuts-knooppunt's chart publishing. No helm repo add/GitHub Pages needed — install via helm install oci://ghcr.io/nuts-foundation/nuts-admin-chart --version <VERSION>.
• Fixes .gitignore: the nuts-admin entry (meant for the built binary at the repo root) was unanchored and also matched charts/nuts-admin/; anchored it to /nuts-admin.
• Adds oidc.existingSecret / oidc.existingSecretKey values: when set, the OIDC client secret is injected as NUTS_OIDC_CLIENT_SECRET from an existing Kubernetes Secret instead of going through config.oidc.client.secret, which would land in the ConfigMap in plaintext. The rest of the OIDC config (enabled, metadata, client.id, scope) still goes through config.oidc.
• Adds a checksum/config pod annotation so pods restart when config.yaml changes.
• Fixes containerPort: it was tied to service.port, so changing the Service's exposed port silently broke health checks/routing since the app still listens on its own configured port. Now derived from config.port (default 1305).
• No autoscaling/HPA support: nuts-admin keeps OIDC sessions in memory, so it can't run more than one replica when OIDC is enabled. The chart fails fast at render time if replicaCount > 1 and config.oidc.enabled are both set.

Once merged and released, nuts-knooppunt's ad-hoc helm/nutsadmin copy can depend on this chart directly instead of maintaining its own.

Closes #329

Test plan

• helm lint charts/nuts-admin
• helm template with default values, and with ingress.enabled=true, config.credentialprofiles[0].*, and oidc.existingSecret overrides — all render valid manifests
• helm template --set replicaCount=2 --set config.oidc.enabled=true fails as intended; replicaCount=1 with OIDC enabled succeeds
• Deployed to a live Kubernetes cluster — works
• Verify the Release Chart workflow publishes correctly to ghcr.io after merge

Assisted by AI

[reinkrul]

Tested this as a drop-in replacement for nuts-knooppunt's own stopgap helm/nutsadmin chart (nuts-foundation/nuts-knooppunt#329) - referenced via a local file:// dependency against this branch, then:

• helm lint / helm template clean against nuts-knooppunt's umbrella chart, no values changes needed - the values shape (env.nutsNodeAddress, config, fullnameOverride, ingress.*) matches exactly
• Deployed for real to nuts-knooppunt's OVHcloud sandbox cluster (infra: scaffold OVHcloud MKS cluster and deploy sandbox stack nuts-knooppunt#581): pod 1/1 Running, no restarts, ingress serving 200s
• Bonus over the stopgap chart: real image tag (6.5.2) and working /status liveness/readiness probes

nuts-knooppunt is holding off switching over until this merges and the chart publishes via chart-releaser (nothing to reference yet from a fresh clone/CI) - left a note there to follow up once it does.