This patch adds `automountServiceAccountToken: false` to various
ServiceAccount objects in order to disable automatic mounting of service
accounts tokens to Pods that never need to use them.

Skipping 22.0.2 as recommended by release notes.

References:
https://www.keycloak.org/2023/09/keycloak-2203-released.html

This patch adjusts the keycloak helm chart to use the upstream
recommended paths for exposing keycloak. It also adjusts the current
deployment to utilise a dedicated, further restricted admin interface.

BREAKING CHANGE: This commit will remove the exposure of the admin
interface as well as other exposed URLs.

References:
https://www.keycloak.org/server/reverseproxy#_exposed_path_recommendations

The helm-unittest upstream has switched back to the helm-unittest
organisation again. Therefore switching to a different image. With the
switch a few minor, but breaking changes have been introduced.

- Dropping helm v2 support
- adjustment of indentation
- enforcing jsonpath for selection

Reference:
https://github.com/helm-unittest/helm-unittest

This patch upgrades keycloak to 20.0.0 and implements the new
adminHostname feature by adding the required variables and a separate
ingress object, which can be utilised for the admin URL and restrict it
independent of the regular frontend.

This patch configures renovate to allow manual addition of a comment
that specifies the image which a helm chart deploys. Should make sure
that no image updates are missed.

This patch adds a new snapshot test that should cover most resources of
the helm chart, instead of just the basic ones, it also renames the
existing job to properly represent what it compares to. This will also
allow to better monitor some of the more complex resources that are
deployed by the chart.

This patch should simply check all resources created by the chart to
contain the recommended Kubernetes labels to be properly identified as
part of the helm chart.

References:
https://kubernetes.io/docs/concepts/overview/working-with-objects/common-labels/