build(deps): update Helm v4 to 4.0.1 and helm-secrets to 4.7.4 (#2304)

* build(deps): update Helm v4 from 4.0.0 to 4.0.1

Update Helm v4 binary and Go library dependency to version 4.0.1.

Changes:
- Update helm.sh/helm/v4 Go module from v4.0.0 to v4.0.1
- Update Helm binary version in all Dockerfiles (alpine, ubuntu, debian)
- Update SHA256 checksums for linux/amd64 and linux/arm64
- Update CI workflow matrix to test against v4.0.1
- Update HelmRecommendedVersion constant in pkg/app/init.go
- Update test mocks to return v4.0.1 version string
- Update test plugin fixture version

Signed-off-by: Aditya Menon <amenon@canarytechnologies.com>

* build(deps): update helm-secrets from 4.7.0 to 4.7.4

Update helm-secrets plugin version across all configurations:
- Docker images (all 3 variants) - use ARG variable for version
- CI test matrix
- Integration test defaults
- Unit test fixtures and expectations
- HelmSecretsRecommendedVersion constant
- Dynamic plugin installation in exec.go

Also update plugin filename format from helm-secrets-*.tgz to
secrets-{version}.tgz to match the new release naming convention.

Update suppress-output-line-regex test expected output for Helm 4.0.1
which now suppresses Service diff after ipFamily normalization.

Signed-off-by: Aditya Menon <amenon@canarytechnologies.com>

---------

Signed-off-by: Aditya Menon <amenon@canarytechnologies.com>

pkg/helmexec/exec.go

@@ -831,7 +831,13 @@ func (helm *execer) installHelmSecretsV4(version string) error {
 	helm.logger.Infof("Installing helm-secrets %s (split plugin architecture for Helm 4)", version)
 
 	baseURL := fmt.Sprintf("https://github.com/jkroepke/helm-secrets/releases/download/%s", version)
-	plugins := []string{"helm-secrets.tgz", "helm-secrets-getter.tgz", "helm-secrets-post-renderer.tgz"}
+	// Strip "v" prefix for filename (e.g., "v4.7.4" -> "4.7.4")
+	versionNum := strings.TrimPrefix(version, "v")
+	plugins := []string{
+		fmt.Sprintf("secrets-%s.tgz", versionNum),
+		fmt.Sprintf("secrets-getter-%s.tgz", versionNum),
+		fmt.Sprintf("secrets-post-renderer-%s.tgz", versionNum),
+	}
 
 	verifyFlag := ""
 	if !helm.options.EnforcePluginVerification {