fix(spire-agent): suffix spire-config ConfigMap name per agent profile (#913)

The spire-config volume (agent.conf) hardcodes
{{ include "spire-agent.fullname" . }} with no $nameSuffix, unlike
every other per-profile resource this chart renders (the ConfigMap
itself, the trust-bundle volume, the DaemonSet name). Any additional
agents.<name> profile's DaemonSet therefore silently mounts the
default profile's agent.conf, regardless of what's configured under
that profile -- workloadAttestors, customPlugins, anything.

Confirmed via a real cluster: an agents.gvisor profile's
disableContainerSelectors never took effect because its DaemonSet was
mounting the default spire-agent ConfigMap the whole time, not
spire-agent-gvisor (which rendered correctly, just was never read).

Verified via `helm template`: additional profiles now get their own
correctly-suffixed ConfigMap reference, matching the DaemonSet's own
name and the trust-bundle volume's existing (correct) behavior.

Signed-off-by: dmorris <[email protected]>
Co-authored-by: dmorris <[email protected]>
Co-authored-by: kfox1111 <[email protected]>

charts/spire/charts/spire-agent/templates/daemonset.yaml

@@ -473,7 +473,7 @@ spec:
       volumes:
         - name: spire-config
           configMap:
-            name: {{ include "spire-agent.fullname" . }}
+            name: {{ printf "%s%s" (include "spire-agent.fullname" .) $nameSuffix | quote }}
         {{- if .Values.keyManager.disk.enabled }}
         - name: spire-key-manager
           {{- if eq .Values.keyManager.disk.mode "hostPath" }}