yopass: add optional read-only deployment (-readonly)

[freinold]

• Add .Values.readOnly.* and render second Deployment/Service/Ingress with -readonly suffix
• Add app.kubernetes.io/component labels/selectors to separate internal vs readonly
• Reuse global DB/metrics; keep single ServiceMonitor
• Update README.md.gotmpl with split deployment docs
• Add example values at ci/readonly-values.yaml

[tboerger]

Thanks for the contribution, this looks really great. If readonly is enabled I would prefer to suffix the internal deployment, service and ingress with -internal, after that I would be happy to merge the change. To get this finally merged you need to increase the minor version, currently it would be 9.5.0.

[tboerger]

To have correct conventional commits I would squash the commits into feat(yopass): add optional read-only deployment.

[tboerger]

@freinold are you willing to spend more time on that? :)

[freinold]

@freinold are you willing to spend more time on that? :)

@tboerger yes, will do this/next week.