#773 fix: apply export-values and import-values to --values, --secret-values, --set and service values

Summary

Make export-values and import-values take effect for values from --values, --secret-values, --set* and service values, not only for chart files.

What

• Export-values export plain values, maps and nulls from every user values layer. Before, a plain value such as --set g.repo=x was not exported, because the parent was read as a table.
• Import-values (map and exports.* string forms) import the child's values from every user values layer.
• Nested parents, multi-level chains (parent → child → grandchild) and aliased subcharts work. Aliases are resolved before user values are exported.
• Mappings apply within each layer, ordered --values < --secret-values < --set* < service values. Within a layer an exported value overrides the child key and an imported value loses to the parent key. Across layers the higher layer wins.
• --set-json key={...} still replaces a map from lower layers, including maps that lower layers got from export-values or import-values.
• For v2 charts, --secret-values and service values are no longer folded into chart values during dependency processing, because they are now user layers. Otherwise they would act as chart defaults for export-values and import-values, and --set-json could not replace them. They are still folded in when the chart values are invalid without them (for example, sub: null in values.yaml).
• The stored release config holds --values < --secret-values < --set* (decrypted) plus what export-values adds from them under the rules above. It does not hold service values, the chart's own secret-values.yaml, or what import-values adds.
• --set* values are applied more than once (to find the paths they set and the maps they replace), so --set-file contents are now cached and each file is read once.
• BREAKING-ish behaviour changes:
  • An exported parent value now overrides the child key from the same or a lower layer. For example, --set g.repo=a --set sub.image.repository=b renders a, and service values exported to sub.image.repository override --set sub.image.repository. Before, the user's child key won.
  • A null parent value in a layer now deletes the exported child key.
  • Dependency condition: values now see plain values exported from user values. Before, only maps were exported.
  • Imported values now follow user values: --set sub.out.k=x changes the parent's imported k.
  • The stored release config follows the new export rules, so a release whose config holds exported values may be redeployed once after updating.
  • For v2 charts with dependencies, the values of the chart stored in the release no longer include --secret-values and service values, except in the fallback case above.

Go API

• values.Options.MergeSetValues takes a new last argument MergeSetValuesOptions. Its SetFilesCache field caches --set-file contents across calls.
• chartv2util.ExportUserValues now takes one layer of values and returns the result instead of modifying a pointer. Added chartv2util.ImportUserValues.

Why

export-values and import-values were applied to chart files only (plus maps from user values), so overriding a parent key from the command line or from werf had no effect on subcharts, and overriding a child key did not reach the importing parent.