This patch moves from labelSelectors to matchExpressions since they are
immune to kustomize commonLabels, which prevents them from being
overwritten by accident.

References:
https://github.com/kubernetes-sigs/kustomize/issues/157
https://github.com/kubernetes-sigs/kustomize/issues/1009

Renovate has made a lot of progress in predefined configs over the past
few years this patch revisits the current config and extends it with the
usage of new presets.

This patch adds `automountServiceAccountToken: false` to various
ServiceAccount objects in order to disable automatic mounting of service
accounts tokens to Pods that never need to use them.

nginx counts parallel requests in HTTP/2 and HTTP/3 as connections.

This patch updates the limits after checking nginx logs to see that the
previously configured limits are exceeded by 100 times.

This patch hopefully fixes issues with sending kill signals to subprocesses from the master process of dovecot.

Exmaple error logs:
```
Jan 25 00:27:16 master: Error: service(auth): kill(14, SIGINT) failed: Operation not permitted
Jan 25 00:28:16 master: Error: service(auth): Process 14 is ignoring idle SIGINT
```

This patch moves the dovecot config from the container build to the helm
chart which allows to use templating with values that are configured at
runtime. This should provide more flexibility and standardizes the
dovecot container further.