Currently, `.Values.certificates.secretName` is no longer supported to provide the `caBundle` that should be supplied to the admission webhooks since the `certificates.cabundle` is no longer queried.

This commit ensures that that functionality is restored for users who are deploying the certificate data as a k8s Secret.

Here are the tests I ran with my changes:

```bash
$ helm template gmsa charts/gmsa | yq e 'select(.kind == "MutatingWebhookConfiguration" or .kind == "ValidatingWebhookConfiguration") | .webhooks[].clientConfig.caBundle'
null
---
null

$ helm template --set 'certificates.certManager.enabled=false' gmsa charts/gmsa | yq e 'select(.kind == "MutatingWebhookConfiguration" or .kind == "ValidatingWebhookConfiguration") | .webhooks[].clientConfig.caBundle'
INSERT_CERTIFICATE_FROM_SECRET
---
INSERT_CERTIFICATE_FROM_SECRET

$ helm template --set 'certificates.certManager.enabled=false' --set 'certificates.caBundle="my-custom-ca-bundle"' gmsa charts/gmsa | yq e 'select(.kind == "MutatingWebhookConfiguration" or .kind == "ValidatingWebhookConfiguration") | .webhooks[].clientConfig.caBundle'

$ helm template --set 'certificates.caBundle="my-custom-ca-bundle"' gmsa charts/gmsa | yq e 'select(.kind == "MutatingWebhookConfiguration" or .kind == "ValidatingWebhookConfiguration") | .webhooks[].clientConfig.caBundle'
null
---
null
```

Currently, the default `nodeselector` in the `values.yaml` of the Helm chart is incorrect since it doesn't actually do anything.

```bash
$ helm template --set="nodeselector.hi=bye" gmsa charts/gmsa | yq e 'select(.kind == "Deployment") | .spec.template.spec.nodeSelector'
kubernetes.io/os: linux

$ helm template --set="nodeSelector.hi=bye" gmsa charts/gmsa | yq e 'select(.kind == "Deployment") | .spec.template.spec.nodeSelector'
kubernetes.io/os: linux
hi: bye
```

To fix this, I'm simply modifying `nodeselector` to `nodeSelector` in the default `values.yaml`.

According to the Kubernetes API reference docs, `podSecurityContext` should correspond to `spec.template.spec.securityContext`.

I'm assuming that the intention of exposing `securityContext` here was to target the `[container]securityContext` of the main container, which should be `spec.template.spec.containers[0].securityContext`.

However, since in the current implementation the `securityContext` and `podSecurityContext` are indented to the same line, one simply overrides the other. So you see this outcome, where the `securityContext` **overrides** the `podSecurityContext` **at a Pod level**:

```bash
$ helm template --set="securityContext.hi=bye" --set="podSecurityContext.hi=windows" gmsa charts/gmsa | yq e 'select(.kind == "Deployment") | {"podSecurityContext": .spec.template.spec.securityContext, "containerSecurityContext": .spec.template.spec.containers[0].securityContext}'
podSecurityContext:
  hi: bye
containerSecurityContext: null
```

To fix this, this commit modifies the indentation to get the correct output. Here is the same command (and a couple of more tests) of the same thing:

```bash
$ helm template gmsa charts/gmsa | yq e 'select(.kind == "Deployment") | {"podSecurityContext": .spec.template.spec.securityContext, "containerSecurityContexts": .spec.template.spec.containers[0].securityContext}'
podSecurityContext: null
containerSecurityContexts: null

$ helm template --set="securityContext.hi=bye" gmsa charts/gmsa | yq e 'select(.kind == "Deployment") | {"podSecurityContext": .spec.template.spec.securityContext, "containerSecurityContext": .spec.template.spec.containers[0].securityContext}'
podSecurityContext: null
containerSecurityContext:
  hi: bye

$ helm template --set="podSecurityContext.hi=windows" gmsa charts/gmsa | yq e 'select(.kind == "Deployment") | {"podSecurityContext": .spec.template.spec.securityContext, "containerSecurityContext": .spec.template.spec.containers[0].securityContext}'
podSecurityContext:
  hi: windows
containerSecurityContext: null

$ helm template --set="securityContext.hi=bye" --set="podSecurityContext.hi=windows" gmsa charts/gmsa | yq e 'select(.kind == "Deployment") | {"podSecurityContext": .spec.template.spec.securityContext, "containerSecurityContext": .spec.template.spec.containers[0].securityContext}'
podSecurityContext:
  hi: windows
containerSecurityContext:
  hi: bye
```

Make formatting changes to the Helm chart

Fix nodeselector to nodeSelector in Helm chart

Ensure that securityContext can be set in Helm chart

This commit adds a new field `.Values.credential.hostAccountConfig` for situations where the default credential deployed by this chart utilizes CCG.

Here are the tests I ran with my changes:

```bash
$ helm template gmsa charts/gmsa | yq e 'select(.kind == "GMSACredentialSpec") | .credspec.ActiveDirectoryConfig.HostAccountConfig'

$ helm template --set="credential.enabled=true" gmsa charts/gmsa | yq e 'select(.kind == "GMSACredentialSpec") | .credspec.ActiveDirectoryConfig.HostAccountConfig'
null

$ helm template --set="credential.enabled=true" --set="credential.hostAccountConfig.badkey=hi" gmsa charts/gmsa | yq e 'select(.kind == "GMSACredentialSpec") | .credspec.ActiveDirectoryConfig.HostAccountConfig'
Error: execution error at (gmsa/templates/credentialspec.yaml:16:29): credential.hostAccountConfig.portableCCGVersion must be provided if credential.hostAccountConfig is set

Use --debug flag to render out invalid YAML

$ helm template --set="credential.enabled=true" --set="credential.hostAccountConfig.portableCcgVersion=1" --set="credential.hostAccountConfig.pluginGUID=myguid" gmsa charts/gmsa | yq e 'select(.kind == "GMSACredentialSpec") | .credspec.ActiveDirectoryConfig.HostAccountConfig'
Error: execution error at (gmsa/templates/credentialspec.yaml:18:22): credential.hostAccountConfig.pluginInput must be provided if credential.hostAccountConfig is set

Use --debug flag to render out invalid YAML

$ helm template --set="credential.enabled=true" --set="credential.hostAccountConfig.pluginGUID=myguid" --set="credential.hostAccountConfig.pluginInput=myinput" gmsa charts/gmsa | yq e 'select(.kind == "GMSACredentialSpec") | .credspec.ActiveDirectoryConfig.HostAccountConfig'
Error: execution error at (gmsa/templates/credentialspec.yaml:16:29): credential.hostAccountConfig.portableCCGVersion must be provided if credential.hostAccountConfig is set

Use --debug flag to render out invalid YAML

$ helm template --set="credential.enabled=true" --set="credential.hostAccountConfig.portableCcgVersion=1" --set="credential.hostAccountConfig.pluginInput=myinput" gmsa charts/gmsa | yq e 'select(.kind == "GMSACredentialSpec") | .credspec.ActiveDirectoryConfig.HostAccountConfig'
Error: execution error at (gmsa/templates/credentialspec.yaml:17:38): credential.hostAccountConfig.pluginGUID must be provided if credential.hostAccountConfig is set

Use --debug flag to render out invalid YAML

$ helm template --set="credential.enabled=true" --set="credential.hostAccountConfig.portableCcgVersion=1" --set="credential.hostAccountConfig.pluginGUID=myguid" --set="credential.hostAccountConfig.pluginInput=myinput" gmsa charts/gmsa | yq e 'select(.kind == "GMSACredentialSpec") | .credspec.ActiveDirectoryConfig.HostAccountConfig'
PortableCcgVersion: "1"
PluginGUID: "{myguid}"
PluginInput: "myinput"
```

Bumps [golang.org/x/net](https://github.com/golang/net) from 0.13.0 to 0.17.0.
- [Commits](golang/net@v0.13.0...v0.17.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>

Add credential.hostAccountConfig for CCG scenario

Infer caBundle from .Values.certificates.secretName

…mission-webhook/golang.org/x/net-0.17.0

Bump golang.org/x/net from 0.13.0 to 0.17.0 in /admission-webhook

Signed-off-by: James Sturtevant <[email protected]>

Release latest chart changes

Signed-off-by: James Sturtevant <[email protected]>

Update to kubernetes 1.29