Unimportant annoyances regarding auth.blt.chrisproject.org

- [ ] Achieving HTTPS for the ingress requires workarounds. The certificate might not be able to automatically renew. See https://github.com/nerc-project/operations/issues/814
- [ ] Authentik is hard-coded to use the `public` schema in the PostgreSQL database, which makes it hard to use Crunchy PGO (because using the `public` schema is considered bad practice) https://github.com/goauthentik/authentik/issues/12154
- [x] Authentik's subchart dependencies on bitnami/postgresql and bitnami/redis are 1 year out-of-date. It would be ideal if we deployed postgresql and valkey (the successor to redis) separately instead of using the bundled subcharts.
- [x] `serviceAccount.create=true` doesn't work on OpenShift, because the role is hard-coded with rules for `apiextensions.k8s.io`, `traefik.containo.us`, and `traefik.io`. See https://github.com/goauthentik/helm/issues/305
- [ ] Use Authentik blueprints to automate provisioning of LDAP for ChRIS.