[SHOT-216] feat: Add generic extra volumes to self-host hook/job and mssql pods

[keithhubner]

🎟️ Tracking

Jira: SHOT-216

Users running the self-host chart with a hardened rootless profile (readOnlyRootFilesystem: true) hit a problem: with a read-only root filesystem, the hook/job and database containers have nowhere to write scratch space (mainly /tmp), so several pods fail. Previously the only workaround was maintaining a local chart patch and re-applying it on every release. This PR upstreams a generic fix.

📔 Objective

Add configurable extraVolumeMounts / extraVolumes to the hook/job and database pods, which previously had no extra-volume support:

• jobs.extraVolumeMounts / jobs.extraVolumes — shared across the five pre/post-install hook & job pods: pre-install-job, pre-install-secret-sql, pre-install-db-migrator-job, post-install-db-migrator-job, post-delete-hook (including the generate-identity-cert and wait-for-db init containers).
• database.extraVolumeMounts / database.extraVolumes — the MSSQL StatefulSet.

This mirrors the existing per-component pattern (e.g. component.api.extraVolumeMounts), so rootless deployments can supply their writable scratch (e.g. a /tmp emptyDir) through values instead of maintaining a chart patch. All keys default to [], so the change is a no-op for existing users (verified: default render is identical to main).

The app-service templates already supported extra volumes upstream and were left unchanged. Example usage is documented in the chart README under Optional Values → Extra Volumes.

Note on writable MSSQL secrets

A common companion need for the rootless MSSQL pod is a writable mssql-secrets volume at /var/opt/mssql/secrets. Under this generic approach that is not hardcoded — it is supplied via database.extraVolumes / database.extraVolumeMounts (see the README example).

✅ Verification

• helm unittest charts/self-host — 149/149 pass (new tests/hook_extras_test.yaml suite covers render + empty-is-no-op for all six templates, including both init containers).
• values.schema.json regenerated with helm-schema 0.23.4 (matches CI schema check).
• ct lint --charts charts/self-host passes.
• Default render diff vs main is empty (aside from randomly-generated secrets).
• Render with sample jobs/database extra values confirms the volume + mount appear in all five Jobs and the MSSQL StatefulSet, producing valid YAML.

[github-actions]

🤖 Bitwarden Claude Code Review

Overall Assessment: APPROVE

Reviewed the addition of jobs.extraVolumeMounts/extraVolumes (across pre-install-job, pre-install-secret-sql, pre-install-db-migrator-job, post-install-db-migrator-job, and post-delete-hook, including the generate-identity-cert and wait-for-db init containers) and database.extraVolumeMounts/extraVolumes on the MSSQL StatefulSet. Verified injection-point indentation against each template's sibling list items, empty-list no-op behavior via {{- with }}, the conditional volumeMounts:/volumes: key emission in post-delete-hook.yaml, schema parity with the existing per-component pattern, and the new hook_extras_test.yaml coverage. The change mirrors the established component.<name>.extraVolumes idiom and is backwards-compatible.

Code Review Details

No findings.

• Indentation of every toYaml . | indent N injection matches its surrounding list items: indent 8 where siblings sit at 8 (all five hook/job pods, mssql volumes), indent 10 for the post-install wait-for-db init container's volumeMounts, and indent 12 for the mssql container volumeMounts.
• All keys default to [], and each injection is wrapped in {{- with }}, so existing renders are unchanged (no-op verified against defaults). post-delete-hook.yaml correctly emits the volumeMounts:/volumes: keys only when the corresponding list is non-empty, since it has no static entries.
• Schema additions match the existing per-component extraVolumeMounts/extraVolumes shape; only the description text differs, consistent with helm-schema generation from the values.yaml comments.
• tests/hook_extras_test.yaml covers render and empty-is-no-op for all six templates, including both init containers.
• No secrets or credentials introduced; extra volumes are user-supplied configuration. Chart version: was not manually bumped, and the version:minor label is applied per project rules.