test(keycloak): make the AppRole/token env negative assertions bite

The notContains checks matched whole array elements, so a name-only
content never equaled the valueFrom entry and the assertion could never
fail. Add any:true so "AppRole stores no static token" and, symmetrically,
"token mode renders no AppRole vars" are actually verified (confirmed by
mutation-testing the template).

Assisted-By: Claude AI
Signed-off-by: Kirill Ilin <stitch14@yandex.ru>

packages/system/keycloak/tests/encryption_test.yaml

@@ -151,6 +151,13 @@ tests:
           content:
             name: KKP_VAULT_ADDR
             value: https://vault.vault.svc:8200
+      # Token auth must not leak AppRole env vars. any:true matches on the
+      # element name alone (helm-unittest otherwise deep-equals whole elements).
+      - notContains:
+          path: spec.template.spec.containers[0].env
+          any: true
+          content:
+            name: KKP_VAULT_ROLE_ID
 
   - it: does not generate a static KEK Secret for the Vault backend
     template: templates/proxy.yaml
@@ -258,8 +265,12 @@ tests:
               secretKeyRef:
                 name: keycloak-vault-approle
                 key: secret-id
+      # AppRole must not store a long-lived token. any:true matches on the
+      # element name alone (helm-unittest otherwise deep-equals whole elements,
+      # so a name-only content would never match the valueFrom entry).
       - notContains:
           path: spec.template.spec.containers[0].env
+          any: true
           content:
             name: KKP_VAULT_TOKEN