feat: add one-shot provisioning for keycloak-users ExternalSecret

When externalSecrets.oneShot is true, the keycloak-users
ExternalSecret becomes an ArgoCD Sync hook with BeforeHookCreation
and deletionPolicy: Retain. This allows a PostSync job in the
rh-keycloak wrapper chart (layered-zero-trust) to delete the
ExternalSecret with --cascade=orphan so the Secret survives
initial provisioning, then clean up ephemeral Secrets labeled
for deletion.

Defaults to false (oneShot disabled) — keycloak-users is a regular
ExternalSecret with no hook annotations. The Secret and
ExternalSecret simply persist. The rh-keycloak wrapper chart in
layered-zero-trust enables it via rhbk.externalSecrets.oneShot.

Also fixes NATURAL_LANGUAGE linter errors: postgresql -> PostgreSQL
in values.yaml comments and README.md.gotmpl.

Bump chart version to 0.0.9.

Signed-off-by: Min Zhang <minzhang@redhat.com>

Author: minmzzhang

Chart.yaml

@@ -4,7 +4,7 @@ keywords:
   - pattern
 name: rhbk
 type: application
-version: 0.0.8
+version: 0.0.9
 home: https://github.com/validatedpatterns/rhbk-chart
 maintainers:
   - name: Validated Patterns Team