Set IAM_SERVICE_URL for Workhorse from iamAuthService

What

Derive the IAM Auth service URL from the existing global.appConfig.iamAuthService.http values and set it as IAM_SERVICE_URL on the Workhorse container.

Why

• Workhorse can route OAuth requests to the IAM Auth service, but today the setting can only be provided by patching a deployment by hand.
• The same address is already configured for Rails through global.appConfig.iamAuthService.http, so it should not have to be set a second time for Workhorse.

Notes

• Env var rather than the Workhorse TOML. The field is toml:"-" in workhorse/internal/config/config.go, so anything rendered into the TOML is dropped at parse time.
• Env var rather than a CLI arg, which would mean patching the Docker entrypoint.
• No new chart value. The variable is rendered only when iamAuthService.enabled is true.
• Default (enabled: false) is unchanged: no variable, and Workhorse sends all OAuth requests to Rails.

Local testing

Rendered the chart with helm template, using the same stub values as the specs (external Redis, PostgreSQL and object storage, which the chart's configuration checks require). For the enabled case, these values were added (grpc and jwtIssuer are required by the configuration checks when the integration is enabled):

global:
  appConfig:
    iamAuthService:
      enabled: true
      http:
        host: iam-auth.example.com
        port: 443
      grpc:
        host: iam-auth.example.com
        port: 5004
      jwtIssuer: https://iam-auth.example.com

With these values, the gitlab-workhorse container has the variable:

- name: IAM_SERVICE_URL
  value: "https://iam-auth.example.com:443"

Without them, the output contains no IAM_SERVICE_URL and is identical to a render with the templates from master, except the randomised test-runner pod name.

Issue: gitlab-org/gitlab#601828