feat: add Helm 4 support while maintaining Helm 3 compatibility (#2262)

This commit adds comprehensive support for Helm 4 while maintaining
full backward compatibility with Helm 3. The implementation includes:

- Updated helm version detection to support both Helm 3 and Helm 4
- Added HELMFILE_HELM4 environment variable to control Helm version
- Modified helm execution paths to handle version-specific binaries
- Updated helm plugin installation to support split architecture

- Helm 4: Uses split plugin architecture (3 separate .tgz files)
  - helm-secrets.tgz
  - helm-secrets-getter.tgz
  - helm-secrets-post-renderer.tgz
- Helm 3: Continues using single plugin installation
- Updated Dockerfiles, CI workflows, and core installation code

- Helm 4 requires post-renderers to be plugins, not executable scripts
- Created Helm plugin structure for integration tests
- Updated helmfile.yaml templates to dynamically select renderer type
- Added test plugins: add-cm, add-cm1, add-cm2

- Updated integration tests for Helm 3/4 compatibility
- Created Helm 4 variant expected output files
- Fixed test determinism issues (repo cleanup between iterations)
- Added version-specific output filtering for warnings/messages

- Updated workflows to test both Helm 3 and Helm 4
- Matrix testing across Helm versions
- Updated helm-diff to v3.14.0 for compatibility

- Updated README and docs with Helm 4 information
- Added migration guidance
- Updated version requirements

All changes are backward compatible - existing Helm 3 users will
see no behavior changes.



fix: update Helm 4 lint expected output to match filtered output

The grep filter removes the semver warning, so the expected output
should not include it. Updated lint-helm4 files to match the filtered
output (warning removed, no extra blank line).

Signed-off-by: Aditya Menon <amenon@canarytechnologies.com>

test/integration/test-cases/diff-args/input/helmfile.yaml

@@ -1,10 +1,10 @@
 helmDefaults:
   diffArgs:
-   - "--three-way-merge"
+    - "--three-way-merge"
 releases:
-  - name: uninstalled 
+  - name: uninstalled
     chart: ../../../charts/httpbin
-    installed: false 
-  - name: installed 
+    installed: false
+  - name: installed
     chart: ../../../charts/httpbin
-    installed: true 
+    installed: true

test/integration/test-cases/diff-args/output/apply-helm4

@@ -0,0 +1,64 @@
+Comparing release=installed, chart=../../../charts/httpbin, namespace=helmfile-tests
+helmfile-tests, installed-httpbin, Deployment (apps) has been added:
+- 
++ apiVersion: apps/v1
++ kind: Deployment
++ metadata:
++   labels:
++     app: httpbin
++     chart: httpbin-0.1.0
++     heritage: Helm
++     release: installed
++   name: installed-httpbin
++   namespace: helmfile-tests
++ spec:
++   replicas: 1
++   selector:
++     matchLabels:
++       app: httpbin
++   strategy: {}
++   template:
++     metadata:
++       labels:
++         app: httpbin
++         release: installed
++     spec:
++       containers:
++       - image: docker.io/citizenstig/httpbin:latest
++         imagePullPolicy: IfNotPresent
++         livenessProbe:
++           httpGet:
++             path: /
++             port: 8000
++         name: httpbin
++         ports:
++         - containerPort: 8000
++         readinessProbe:
++           httpGet:
++             path: /
++             port: 8000
++         resources: {}
++ status: {}
+helmfile-tests, installed-httpbin, Service (v1) has been added:
+- 
++ apiVersion: v1
++ kind: Service
++ metadata:
++   labels:
++     app: httpbin
++     chart: httpbin-0.1.0
++     heritage: Helm
++     release: installed
++   name: installed-httpbin
++   namespace: helmfile-tests
++ spec:
++   ports:
++   - name: httpbin
++     port: 8000
++     protocol: TCP
++     targetPort: 8000
++   selector:
++     app: httpbin
++     release: installed
++   type: LoadBalancer
+

test/integration/test-cases/diff-args/output/apply-live-helm4

@@ -0,0 +1,72 @@
+helmfile-tests, installed-httpbin, Deployment (apps) has been added:
+- 
++ apiVersion: apps/v1
++ kind: Deployment
++ metadata:
++   labels:
++     app: httpbin
++     chart: httpbin-0.1.0
++     heritage: Helm
++     release: installed
++   name: installed-httpbin
++   namespace: helmfile-tests
++ spec:
++   replicas: 1
++   selector:
++     matchLabels:
++       app: httpbin
++   strategy: {}
++   template:
++     metadata:
++       labels:
++         app: httpbin
++         release: installed
++     spec:
++       containers:
++       - image: docker.io/citizenstig/httpbin:latest
++         imagePullPolicy: IfNotPresent
++         livenessProbe:
++           httpGet:
++             path: /
++             port: 8000
++         name: httpbin
++         ports:
++         - containerPort: 8000
++         readinessProbe:
++           httpGet:
++             path: /
++             port: 8000
++         resources: {}
++ status: {}
+helmfile-tests, installed-httpbin, Service (v1) has been added:
+- 
++ apiVersion: v1
++ kind: Service
++ metadata:
++   labels:
++     app: httpbin
++     chart: httpbin-0.1.0
++     heritage: Helm
++     release: installed
++   name: installed-httpbin
++   namespace: helmfile-tests
++ spec:
++   ports:
++   - name: httpbin
++     port: 8000
++     protocol: TCP
++     targetPort: 8000
++   selector:
++     app: httpbin
++     release: installed
++   type: LoadBalancer
+Error: identified at least one change, exiting with non-zero exit code (detailed-exitcode parameter enabled)
+Error: plugin "diff" exited with error
+Comparing release=installed, chart=../../../charts/httpbin, namespace=helmfile-tests
+Release "installed" does not exist. Installing it now.
+NAME: installed
+NAMESPACE: helmfile-tests
+STATUS: deployed
+REVISION: 1
+DESCRIPTION: Install complete
+TEST SUITE: None

test/integration/test-cases/diff-args/output/apply-live-stderr-helm4

@@ -0,0 +1,10 @@
+Live output is enabled
+Building dependency release=installed, chart=../../../charts/httpbin
+Listing releases matching ^uninstalled$
+Upgrading release=installed, chart=../../../charts/httpbin, namespace=helmfile-tests
+Listing releases matching ^installed$
+
+
+UPDATED RELEASES:
+NAME        NAMESPACE        CHART                     VERSION   DURATION
+

test/integration/test-cases/diff-args/output/apply-stderr-helm4

@@ -0,0 +1,17 @@
+Building dependency release=installed, chart=../../../charts/httpbin
+Listing releases matching ^uninstalled$
+Upgrading release=installed, chart=../../../charts/httpbin, namespace=helmfile-tests
+Release "installed" does not exist. Installing it now.
+NAME: installed
+NAMESPACE: helmfile-tests
+STATUS: deployed
+REVISION: 1
+DESCRIPTION: Install complete
+TEST SUITE: None
+
+Listing releases matching ^installed$
+
+
+UPDATED RELEASES:
+NAME        NAMESPACE        CHART                     VERSION   DURATION
+