Don't expose services via load balancers publicly by default. Take the chart more towards "secure-by-default" direction

**Is your feature request related to a problem? Please describe.**

Don't expose services via load balancers publicly by default. Take the chart more towards "secure-by-default" direction

The current defaults for the Helm chart aren't "secure-by-default".
There's no authentication in the Helm chart by default and public load balancers are used by default in a deployment to Google Cloud GKE, Azure AKS or AWS EKS.

**Describe the solution you'd like**

No services should have `type: LoadBalancer` by default to mitigate the problem. No ingress should be enabled by default.

The current services that are `type: LoadBalancer` should be related by `type: ClusterIP`. A user that wants a load balancer can change the configuration.

**Describe alternatives you've considered**

By default, load balancers should [have annotations that make them internal](https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer) on GKE, AKS and EKS so that the risk of a lazy user exposing a cluster publicly could be reduced.

```yaml
annotations:
service.beta.kubernetes.io/aws-load-balancer-internal: "true"
service.beta.kubernetes.io/azure-load-balancer-internal: "true"
networking.gke.io/load-balancer-type: "Internal"
```

**Additional context**

In addition, the README should have a disclaimer that exposing Pulsar on the public internet is not recommended at all.