chore: prepare keycloak v26.7.2 release

[mikkeldamsgaard]

Release keycloak 26.7.2 — the chart version syncs with the upstream Keycloak appVersion, already bumped on main via #136.

Changes since the keycloak-26.6.3 tag:

• Security: Keycloak 26.6.3 → 26.7.2. Fixes CVE-2026-59888 / CVE-2026-59889 (jackson-databind) and CVE-2026-9796 (admin role rename TOCTOU allowing realm-wide escalation from manage-clients). Goes straight to .2 because 26.7.2 also fixes an upgrade failure where the stateless cluster provider captured a null NodeInfo before postInit.
• Changed: initial admin now uses KC_BOOTSTRAP_ADMIN_USERNAME / KC_BOOTSTRAP_ADMIN_PASSWORD instead of the deprecated KEYCLOAK_ADMIN variables (which logged KC-SERVICES0110 on every start). No values change — admin.username and admin.password are unchanged.

No KC_* option used by this chart changed upstream; the options removed in 26.7.0 (persistent-session batching, token-exchange-external-internal:v2) are not used here, and ports, health endpoints, and the entrypoint are unchanged.

Merging this triggers the release workflow (GHCR OCI push, keycloak-26.7.2 tag, GitHub release).

How to verify

helm lint charts/keycloak      # clean
helm unittest charts/keycloak  # 103 tests passing
make e2e-keycloak              # dev / postgres / replicas all passed locally on 26.7.2,
                               # re-run after the KC_BOOTSTRAP_ADMIN_* switch

🤖 Generated with Claude Code