Allow unauthenticated access to OIDC discovery endpoints by deploying
the oidc-reviewer ClusterRoleBinding to all site and global clusters.

We do enforcement on the apache/mod_oauth2 level instead.

Without domain ID provided, it was defaulting to 'Default' rather than a
'service'.

K8s Secret data fields require base64-encoded values; stringData accepts
plain text and lets the API server handle encoding.

Without this, the auth plugin switches back to requesting unscoped
tokens which results in the empty service catalog and services not
working.

This is following merge of
https://review.opendev.org/c/openstack/openstack-helm/+/993881

09aa5fd removed the stray trailing "f" from the a659ab8a2 hash but
left the version numbers unchanged. Helm's chart-repo resolution
ignores semver build metadata (the "+hash" suffix) when matching, so
each pin was silently resolving to whatever pre-fix build already
existed under that version number instead of erroring. Bump every
chart's version number to the one actually published alongside
a659ab8a2 (verified against the tarballs.opendev.org index) so the
identity.openrc wiring fix actually gets deployed.

The chart gained native pod.etcSources support for cinder-ks-etc back
in Feb 2026 (upstream commit 06a5261a0), which unconditionally
declares a cinder-etc-snippets volume (projected, or an emptyDir
fallback when etcSources is empty). Our own pod.mounts override
predates that (Sep 2025) and injects a volume of the same name, so
every cinder Deployment/CronJob ended up with two "cinder-etc-snippets"
volumes. Switch to pod.etcSources for the components that support it
and drop the now-redundant custom mounts. cinder_db_sync keeps its
manual mount since that job template has no etcSources support.