helm: make the Postgres role and bootstrap database configurable for SV charts

[SLoeuillet]

Follow-up to #6803, as agreed there. That PR was cut down to validator + participant so the validator use case could land early; this carries the parts that were held back.

No rush on merging this one. You said you would not merge the SV charts without cluster test coverage for SV deployments, and that such coverage is planned as part of a security-hardening story. This is here so the work is not lost and is ready when that lands — review it whenever it suits you.

What it covers

splice-sv-node, splice-scan, splice-global-domain (sequencer + mediator), splice-domain, and splice-splitwell-app.

Same shape as #6803: persistence.user and persistence.bootstrapDatabaseName replace the hardcoded cnadmin role and cantonnet bootstrap database, defaulting to those values so rendered output is byte-identical unless you set them.

With this, rg -- '--dbname=cantonnet|--username=cnadmin' cluster/helm/ returns nothing across the whole tree.

The node-level half

The domain, mediator and sequencer needed the same second fix the participant did: canton-base's storage.conf reads user = ${?CANTON_DOMAIN_POSTGRES_USER} and the charts never set it, so the node kept connecting as cnadmin even with persistence.user configured — the half-applied configuration we discussed on #6803.

The sequencer's cantonbft-driver init container was a second instance of the original problem: it already derived host, port and user from values but connected to a hardcoded bootstrap database. It now derives that the same way, via a $dbBootstrap template variable exposed as DB_BOOTSTRAP, matching the file's own idiom rather than inlining an expression into the shell script.

Why splitwell is here

It is neither a validator nor an SV component, so it seemed to belong with the batch waiting for new coverage rather than with the one you merged on the strength of the validator testing. Happy to move it if you would rather have had it in #6803.

Tests

Two tests on the global-domain mediator assert persistence.user reaches the node's env and that nothing is emitted when unset; both were checked to fail without the change. Every touched chart's suite gives the same results as main.

The release-notes entry from #6803 is extended rather than duplicated, since both ship in the same release.

Testing this on a cluster

For whenever the SV coverage exists, the setup that made the #6803 validation meaningful was initialising Postgres with POSTGRES_USER=appuser / POSTGRES_DB=bootstrapdb so that cnadmin and cantonnet do not exist — otherwise the test passes whether or not the values are honoured. The unpatched charts then fail loudly with password authentication failed for user "cnadmin", which is what makes it a real check.