[G-08] Add a clusterDomain value

## Summary
The chart hardcodes `svc.cluster.local` everywhere it builds an in-cluster FQDN. There is no value to override it, so on clusters with a custom DNS domain the generated publish URIs, Datanode seed hosts, and TLS SAN check all point at a domain that does not exist.

### Details
Hardcoded occurrences (no `clusterDomain` or `global.clusterDomain` value exists anywhere):

- `_helpers.tpl:323`: Datanode discovery seed hosts, consumed at `statefulsets/datanode.yaml:90`.
- `_helpers.tpl:477`: `graylog.publishUri`, consumed as `GRAYLOG_HTTP_PUBLISH_URI` at `statefulsets/graylog.yaml:136`.
- `config/init-graylog.yaml:21`: the init script checks the certificate against `test...svc.cluster.local`, requiring the wildcard SAN `DNS:*...svc.cluster.local`.
- `statefulsets/datanode.yaml:89`: `GRAYLOG_DATANODE_NODE_NAME` (not listed in the original audit item).

The SAN requirement docs (`charts/graylog/README.md:532`, `docs/TESTING.md:397`) must change together with the templates. Other doc occurrences are user-supplied endpoint examples and can stay as they are.

**Reference:** G-08 (Production Readiness Review)

### Impact
On a non-default DNS domain the publish URI does not resolve, so Graylog nodes cannot reach each other, and the Datanode seed hosts do not resolve, so OpenSearch discovery and cluster formation break. With TLS enabled the init container rejects certificates issued for the cluster's real domain, so pods exit before Graylog starts.

## Notes for maintainers
- Add a `clusterDomain` value defaulting to `cluster.local`, thread it through the four template locations above, and update the SAN docs to match. Convention choice: top-level `clusterDomain` or the Bitnami-style `global.clusterDomain`. The chart has no subcharts today, so either works, but pick deliberately.
- Related observation from verification: the publish URI depends on per-pod DNS records, but the Graylog governing Service is plain ClusterIP (`service/graylog.yaml:10`) while Kubernetes only publishes per-pod records for headless Services (the Datanode Service is headless, `service/datanode.yaml:13`). Possibly a separate latent issue worth checking while in this code.

Start with the four hardcoded locations in _helpers.tpl, statefulsets/datanode.yaml, statefulsets/graylog.yaml, and config/init-graylog.yaml, then review the SAN guidance in charts/graylog/README.md and docs/TESTING.md. Choose deliberately between a top-level and global value. Done means the default remains cluster.local, all four generated domains use the configurable value, and the SAN documentation matches.

Written by the indexing model from the issue text.