feat(defender): add defender.existingSecret for defender-only certificates

Summary

• Adds defender.existingSecret for defender-only mode.
• When set, the chart renders no defender Secret and the DaemonSet mounts the named one.
• Certificate material no longer has to pass through Helm values, so the release templates in CI.
• Defaults off; the values path and its required() guards are unchanged.

Why

• CI render jobs skip SOPS-encrypted valuesFrom Secrets, so defender-only releases fail the required() certificate guards.
• Decrypting them in CI would put the certificates in the rendered artifacts.
• existingSecret keeps the certificates in a Secret the chart only mounts, so the render passes and the certificates stay encrypted.

What changed

• defender/secrets.yaml skips rendering when existingSecret is set.
• defender/daemonset.yaml mounts existingSecret, falling back to the chart Secret name.
• values.yaml documents the value and the nine keys the Secret must carry.
• docs/DEFENDER_ONLY.md adds the pre-created Secret path as the recommended setup.

Upgrade Notices

• No action needed; the value defaults off.
• Existing defender-only deployments render the same Secret and mount as before.

Linked Issue

• Closes issue.
• Same pattern as sso.existingSecret in !351 (merged).

Relevant logs/screenshots

• helm lint and stock helm template pass.
• helm unittest: 5 suites, 38 tests pass, 4 new.
• Defender-only render with existingSecret emits no chart Secret and mounts the named one.
• Defender-only render with neither still fails on the required() guard.