kyverno 3.9.0 추가 — 자체 빌드 이미지 사용, 3.4.1 정리 (#57)

* kyverno 3.9.0(appVersion v1.19.0) 차트 추가 — 자체 빌드 이미지 사용

업스트림 이미지가 CVE 스캔 불가능한 베이스를 써서 자체 빌드로 대체한다(빌드 정의·근거는
hardened-containers). custom-values.yaml이 docker.io/paasup/* 7개 이미지를 가리키도록
고정했다.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* kyverno 3.4.1 삭제
3.9.0 추가 후 정리

---------

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

manifests/helm/kyverno/3.9.0/templates/reports-server/_helpers.tpl

@@ -0,0 +1,58 @@
+{{/*
+Reports Server helpers
+*/}}
+
+{{/*
+Check if reports-server is enabled
+*/}}
+{{- define "kyverno.reportsServer.enabled" -}}
+{{- if .Values.reportsServer.enabled -}}
+true
+{{- else -}}
+false
+{{- end -}}
+{{- end -}}
+
+{{/*
+Reports Server readiness init container
+*/}}
+{{- define "kyverno.reportsServer.initContainer" -}}
+{{- if and .Values.reportsServer.enabled .Values.reportsServer.waitForReady }}
+- name: wait-for-reports-server
+  image: {{ include "kyverno.image" (dict "globalRegistry" .Values.global.image.registry "image" .Values.test.image "defaultTag" .Chart.AppVersion) | quote }}
+  imagePullPolicy: {{ .Values.test.image.pullPolicy | default "IfNotPresent" }}
+  args:
+    - check-endpoints
+    - --service-name={{ .Release.Name }}-reports-server
+    - --namespace={{ .Release.Namespace }}
+    - --timeout={{ .Values.reportsServer.readinessTimeout }}
+  securityContext:
+    runAsUser: 65534
+    runAsGroup: 65534
+    runAsNonRoot: true
+    privileged: false
+    allowPrivilegeEscalation: false
+    readOnlyRootFilesystem: true
+    capabilities:
+      drop:
+        - ALL
+    seccompProfile:
+      type: RuntimeDefault
+  resources:
+    limits:
+      cpu: 100m
+      memory: 128Mi
+    requests:
+      cpu: 10m
+      memory: 32Mi
+{{- end }}
+{{- end }}
+
+{{/*
+Reports Server service dependency annotation
+*/}}
+{{- define "kyverno.reportsServer.dependsOnAnnotation" -}}
+{{- if .Values.reportsServer.enabled }}
+"helm.sh/hook-depends-on": "Service/reports-server"
+{{- end -}}
+{{- end -}}