[FEATURE] Make Helm chart configurable to satisfy Gatekeeper / Pod Security policies #442

Is your feature request related to a problem or existing issue? Please describe.

The charts/node-readiness-controller Helm chart has two configurability gaps that prevent it from passing common Gatekeeper (gatekeeper-library) constraints without manually editing templates:

1. automountServiceAccountToken is neither set nor exposed. Several Gatekeeper policies require this field to be explicitly set on the ServiceAccount and/or pod spec. The chart does not render it anywhere today, so those constraints reject the workload.
2. No extraVolumes / extraVolumeMounts values. These are needed to inject a projected ServiceAccount token when automountServiceAccountToken: false. The controller uses rest.InClusterConfig(), which requires token + ca.crt + namespace at /var/run/secrets/kubernetes.io/serviceaccount, so there is currently no way to run token-free without patching templates.

Describe the solution you'd like

Expose the missing knobs in the chart:

• values.yaml: add serviceAccount.automountServiceAccountToken (default true), plus extraVolumes: [] and extraVolumeMounts: [] with a documented projected-token example.
• templates/serviceaccount.yaml: render automountServiceAccountToken.
• templates/deployment.yaml: render pod-level automountServiceAccountToken and wire extraVolumes / extraVolumeMounts.

Example for running with the token disabled (all three sources required, or InClusterConfig fails):

serviceAccount:
  automountServiceAccountToken: false
extraVolumes:
  - name: sa-token
    projected:
      sources:
        - serviceAccountToken:
            path: token
            expirationSeconds: 3600
        - configMap:
            name: kube-root-ca.crt
            items:
              - key: ca.crt
                path: ca.crt
        - downwardAPI:
            items:
              - path: namespace
                fieldRef:
                  fieldPath: metadata.namespace
extraVolumeMounts:
  - name: sa-token
    mountPath: /var/run/secrets/kubernetes.io/serviceaccount
    readOnly: true

Describe alternatives you've considered

• Keeping the chart as-is and having operators fork/patch templates to satisfy their policy — rejected as poor UX and hard to maintain.
• A token-only projected volume — does not work: missing ca.crt causes TLS verification failure against the API server, so the full three-source volume is required.