fix(platform tests): make negated containsDocument assertions load-bearing with any: true - #3929

…ck nothing (#4664)

## What this PR does

Twenty-one helm-unittest cases asserted only that something is absent
from a document, and could pass without ever looking at the document
they name. This PR makes each of them fail when that happens.

1. Thirteen cases picked their document by position: mongodb (4), nats
certmanager (3), opensearch (3), qdrant certmanager (2), seaweedfs
cluster_scoped_names (1). When a template gains or reorders a document,
the index points at some other object that also lacks the field, and the
case stays green. These now use `documentSelector` on `kind` or
`metadata.name`, like the earlier harbor conversion.
2. Seven cases had no selector at all, on templates wrapped in a
top-level `if`: kubernetes cilium_gateway_alpn, mongodb restore,
linstor-scheduler admission, seaweedfs s3_traffic_distribution and three
in vertical-pod-autoscaler. If a values change turns the condition off,
the render is empty and the absence check passes on nothing. A
`documentSelector` turns an empty render into `document not found`.
3. The redis null-namespace case checked that the in-cluster name is
present, but never that the external name is absent. It now asserts that
neither `my-redis.` nor `my-redis.example.com` (the suite-level host
that `_namespace: null` must override) is in the SAN list.

The `kubernetes cluster` entry in the #3634 catalog no longer applies,
since `packages/apps/kubernetes/tests/cluster_test.yaml` has been
removed from main. I did not add the `my-redis.redis.` check that #4621
mentions, because the per-engine SAN it refers to has not landed.

Each case was checked by mutation. I broke the template in a way the old
case could not see, then ran the chart's `make test` with the new test
file and with the one from main. For group 1 I removed the guard and put
an extra document in front of the target. For group 2 I turned off the
top-level condition. For group 3 I let the empty-host branch emit the
bare SAN. Every time the main version stayed green and the new one went
red, and the fixed cases were the only extra failures. All templates are
back to their committed bytes.

Follow-ups, not in this PR:

- The same absence-only shape has appeared in more cases since #3634 was
filed: mongodb `tls_test.yaml` (8 cases), mariadb `tls_test.yaml` (6),
redis `tls_test.yaml` (2 more), kubernetes
`kamaji_managed_args_test.yaml` (2), and one each in kafka
`dashboard-resourcemap_test.yaml`, cert-manager-issuers
`solver_test.yaml` and seaweedfs `volume_resize_hook_test.yaml`. They
need a separate issue. The four platform `bundles_proxy_protocol*` cases
are #3864, handled in #3929.

Closes #3634

Closes #4621

### Screenshots

Not applicable, test-only change.

### Downstream repositories

- [x] No downstream repository is affected by this change
- [ ] [cozystack/website](https://github.com/cozystack/website) -
follow-up:
- [ ]
[cozystack/terraform-provider-cozystack](https://github.com/cozystack/terraform-provider-cozystack)
- follow-up:
- [ ]
[cozystack/ansible-cozystack](https://github.com/cozystack/ansible-cozystack)
- follow-up:
- [ ] [cozystack/ccp](https://github.com/cozystack/ccp) - follow-up:
- [ ] [cozystack/talm](https://github.com/cozystack/talm) - follow-up:
- [ ] [cozystack/cozyhr](https://github.com/cozystack/cozyhr) -
follow-up:
- [ ] [cozystack/cozy-proxy](https://github.com/cozystack/cozy-proxy) -
follow-up:
- [ ]
[cozystack/cozystack-telemetry-server](https://github.com/cozystack/cozystack-telemetry-server)
- follow-up:
- [ ]
[cozystack/external-apps-example](https://github.com/cozystack/external-apps-example)
- follow-up:
- [ ] [cozystack/examples](https://github.com/cozystack/examples) -
follow-up:
- [ ] [cozystack/community](https://github.com/cozystack/community) -
follow-up:

### Release note

```release-note
NONE
```


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Tests**
* Updated chart validation to identify rendered resources by their type
or name rather than relying on document order, improving consistency
across Kubernetes applications.
* Expanded Redis TLS checks to verify that certificates omit generic and
external hostnames when no namespace data is provided.
* Kept existing expected behavior checks for gateway, database,
messaging, search, storage, and autoscaling resources.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->