Expose OIDC_TRUST_UNVERIFIED_EMAIL and document the 2.1.x verified-email requirement #8

Background

PatchMon 2.1.0 started requiring identity providers to assert that a user's email address
is verified, whenever PatchMon has to identify someone by email rather than by an already
linked identity. Without that assertion the login is refused with:

oidc login rejected: unverified email claim

This is a deliberate fix for the nOAuth account-takeover class of attack, so the default
is correct and should stay. But it does mean SSO can stop working on upgrade:

• Authentik — needs the default email scope mapping replaced with one that reports
  the address as verified.
• Entra ID — never sends email_verified. 2.1.2 made PatchMon read Microsoft's
  xms_edov claim instead, which has to be added as an ID token optional claim on the
  app registration.
• Keycloak, Okta, Google Workspace — unaffected.

For directories that have no concept of a verified email at all, 2.1.2 added an opt-in
escape hatch: OIDC_TRUST_UNVERIFIED_EMAIL (off by default).

The gap

The chart maps ~17 OIDC_* variables in charts/patchmon/templates/configmap-server.yaml
but not this one, so a chart user whose SSO breaks after upgrading has no supported way to
set it. We shipped appVersion 2.1.3 in #7, so this is live for anyone upgrading now.

What to do

1. Add the value in charts/patchmon/values.yaml, in the patchmon.oidc block:

    # Allows login when the provider cannot assert the email address is verified.
    # Off by default, and deliberately so: with this on, anyone who can set their own
    # email address at your IdP can sign in as an existing PatchMon user with that
    # address. Only reasonable when you control who can change addresses in your
    # directory. Prefer fixing the provider (Authentik scope mapping, Entra xms_edov).
    trustUnverifiedEmail: false

2. Map it in charts/patchmon/templates/configmap-server.yaml, alongside the other
OIDC keys, following the existing ternary pattern:

  OIDC_TRUST_UNVERIFIED_EMAIL: {{ ternary "true" "false" .Values.patchmon.oidc.trustUnverifiedEmail | quote }}

3. Add an upgrade note to the README covering the 2.0.x → 2.1.x jump: what the error
looks like, the Authentik and Entra fixes, and this value as the last resort rather than
the first move.

Notes

• Every login the option permits is written to the PatchMon server log, worth mentioning
  in the README note.
• Only worth a patch bump on its own, or fold it into the next release.

Upstream docs: https://patchmon.net/docs/patchmon-operator-guide/setting-up-oidc-sso#the-verified-email-requirement