OAK: add OpenBao Helm values generation

What does this MR do?

Closes #9854 (closed) — Helm values file generation for modular features co-located with the GitLab Linux package.

Adds the initial openbao-helm-values.yaml.erb template plus generic enable/disable recipes under the new oak cookbook. When oak['components']['openbao']['enable'] is true, gitlab-ctl reconfigure writes a ready-to-consume Helm values file at oak['components']['openbao']['helm_values_path'] (default /etc/gitlab/openbao-helm-values.yaml). When the component is disabled (or oak['enable'] is globally false), the same reconfigure deletes the file.

Sample generated file

config:
  storage:
    postgresql:
      haEnabled: true
      connection:
        host: "10.128.15.216"          # auto: oak['network_address']
        port: 5432                      # auto: Omnibus PostgreSQL port
        database: "openbao"             # opinionated default
        username: "openbao"             # opinionated default
        password:
          secret: openbao-db-password   # opinionated default — operator creates this k8s Secret
          key: password
  initialize:
    enabled: true
    oidcDiscoveryUrl: "https://gitlab.example.com"   # auto: gitlab['external_url']
    boundIssuer: "https://gitlab.example.com"        # auto: gitlab['external_url']
    boundAudiences: '"https://openbao.example.com"'  # auto: oak['components']['openbao']['external_url']

What is auto-filled vs operator-provided?

Field	Source
config.storage.postgresql.connection.host	Auto: oak['network_address']
config.storage.postgresql.connection.port	Auto: Omnibus PostgreSQL port
config.storage.postgresql.haEnabled	Always true (required for OpenBao's PostgreSQL service_registration)
config.storage.postgresql.connection.database	Opinionated default "openbao" — operator creates the database before helm install
config.storage.postgresql.connection.username	Opinionated default "openbao" — operator creates the role
config.storage.postgresql.connection.password.secret	Opinionated default openbao-db-password — operator creates the k8s Secret
config.initialize.oidcDiscoveryUrl / boundIssuer	Auto: gitlab['external_url']
config.initialize.boundAudiences	Auto: oak['components']['openbao']['external_url']

What is NOT generated

Operator-environment values (autoscaling, gatewayRoute, ingress.hostname, staticUnsealSecret, etc.) remain runbook-provided. The chart is invoked with both files merged:

helm upgrade --install openbao \
  oci://registry.gitlab.com/gitlab-org/charts/openbao \
  -f /etc/gitlab/openbao-helm-values.yaml \
  -f <runbook-values.yaml>

Related issues

Closes #9854 (closed)

Checklist

See Definition of done.

For anything in this list which will not be completed, please provide a reason in the MR discussion.

Required

• MR title and description are up to date, accurate, and descriptive.
• MR targeting the appropriate branch.
• Latest Merge Result pipeline is green.
• When ready for review, MR is labeled workflowready for review per the Distribution MR workflow.
• The UBT version and corresponding checksum hash have been updated and referenced in the merge request if applicable.
  • UBT EE pipeline (Trigger:ee-package-ubt) is green

For GitLab team members

If you don't have access to this, the reviewer should trigger these jobs for you during the review process.

• The manual Trigger:ee-package jobs have a green pipeline running against latest commit.
  • To debug QA failures, refer to the Investigate QA failures section.
• If config/software or config/patches directories are changed, make sure the build-package-on-all-os job within the Trigger:ee-package downstream pipeline succeeded.
• If you are changing anything SSL related, then the Trigger:package:fips manual job within the Trigger:ee-package downstream pipeline must succeed.
• If CI configuration is changed, the branch must be pushed to dev.gitlab.org to confirm regular branch builds aren't broken.

Expected (please provide an explanation if not completing)

• Test plan indicating conditions for success has been posted and passes.
• Documentation created/updated.
• Tests added.
• Integration tests added to GitLab QA.
• Equivalent MR/issue for the GitLab Chart opened.
• Validate potential values for new configuration settings. Formats such as integer 10, duration 10s, URI scheme://user:passwd@host:port may require quotation or other special handling when rendered in a template and written to a configuration file.