feat: add one-shot provisioning for keycloak-users ExternalSecret

When externalSecrets.oneShot is true, the keycloak-users
ExternalSecret switches from HookSucceeded to BeforeHookCreation
delete policy and sets deletionPolicy: Retain. This allows a
PostSync job in the rh-keycloak wrapper chart (layered-zero-trust)
to delete the ExternalSecret with --cascade=orphan so the Secret
survives initial provisioning, then clean up ephemeral Secrets
labeled for deletion.

Defaults to false (oneShot disabled) to preserve the existing
HookSucceeded behavior. The rh-keycloak wrapper chart in
layered-zero-trust enables it via rhbk.externalSecrets.oneShot.

Bump chart version to 0.0.9.

Signed-off-by: Min Zhang <minzhang@redhat.com>

Author: minmzzhang

Chart.yaml

@@ -4,7 +4,7 @@ keywords:
   - pattern
 name: rhbk
 type: application
-version: 0.0.8
+version: 0.0.9
 home: https://github.com/validatedpatterns/rhbk-chart
 maintainers:
   - name: Validated Patterns Team