This patch refactors the entire ingress setup into two ingress classes:
internet and intranet. This allows to ensure that they use separate
services, reduces the attack surface and enables the usage of
external-dns.

This patch introduces a new container to the jellyfin instance that
talks to the kubernetes API and manages a PDB for jellyfin. It blocks
evictions while at least one device is playing a video.

This should prevent awkward situations during updates.