feat(helm): allow a per-set sssd.conf for LoginSet and NodeSet

[AndreyZa]

Summary

sssdConfRef is a per-set field on both LoginSet and NodeSet, but the chart can only fill it from the cluster-wide value: slurm.sssdConf.name reads .Values.sssd.secretRef and never sees the set it is rendering. Every LoginSet and NodeSet in a release therefore resolves identities from the same directory.

That becomes limiting as soon as one cluster serves two populations from two directories. Our case: a shared login for staff, whose sssd.conf points at the institute directory and whose pod mounts the shared /home, and a separate login for students, whose sssd.conf points at a different directory. A single shared sssd.conf would give both sets both domains — precisely what the split exists to prevent, since the staff login exposes home directories the students must not reach.

The only workaround today is to patch sssdConfRef on the CR after install. That patch survives an ordinary helm upgrade (the field is identical in the old and new rendered manifests, so it is not part of the patch Helm computes), but it is silently lost when the global sssd.secretRef changes, when the CR is recreated, or when the release is reinstalled — and the failure mode is a login where users simply "do not exist".

Change

loginsets.<name>.sssd.secretRef and nodesets.<name>.sssd.secretRef now take precedence over the cluster-wide sssd.secretRef, falling back to it when unset. Three small edits:

• templates/loginset/loginset-cr.yaml — dig the per-set value, default to the existing helper;
• templates/nodeset/nodeset-cr.yaml — same, before ssh.sssdConfRef is set;
• values.yaml — the new key documented under loginsetDefaults and nodesetDefaults, plus the regenerated README.

The helpers themselves are untouched, so the cluster-wide value keeps working exactly as before.

Related: #119 wired sssd.secretRef through to the CR in the first place; this makes that wiring per-set.

Checklist

• I have read the CONTRIBUTING.md and the Code of Conduct.
• New or existing tests cover these changes (where applicable). (Chart change verified by rendering, see below.)
• Documentation is updated if user-visible behavior changes. (values.yaml comments and the helm-docs README.)

Breaking Changes

None. With no per-set value present the rendered sssdConfRef is byte-for-byte what it was.

Testing Notes

helm template against a release with a global secret plus one overriding LoginSet and one overriding NodeSet:

set	sssdConfRef.name
LoginSet staff (no override)	global-sssd
LoginSet students (override)	students-sssd
NodeSet cpu (no override)	global-sssd
NodeSet edu (override)	students-sssd

Defaults unchanged: a release with no sssd.secretRef and no per-set value renders <release>-sssd-conf; with only the global value set it renders that value. helm lint helm/slurm passes, make helm-docs produces no further diff.

Additional Context

Found while adding a student-facing login to a cluster that already had a staff login: the second LoginSet came up with the first one's domain, and users of the second directory were unresolvable with no error anywhere — the pod is healthy, getent simply returns nothing.

[vivian-hafener]

Please add Helm unit tests to cover the added behavior. Also, the commit does not include the project's required git trailers.