chore: bump netbird to 0.72.3 and keycloak to 26.6.3

[mikkeldamsgaard]

Summary

Folds in all 17 open autorelease upstream-update issues.

netbird

• Bump appVersion 0.68.3 → 0.72.3. Upstream adds IPv6 overlay addressing (opt-in), MFA for embedded-IdP users, private service expose over tunnel peers, and a WebSocket relay fallback for oversized QUIC datagrams. Release-note review found no removed config options, env vars, or ports; DB migrations are automatic.
• Bump dashboard image v2.32.4 → v2.39.0 — the dashboard release paired with server 0.72.x.

keycloak

• Bump appVersion 26.6.1 → 26.6.3. Pure security/bugfix patch releases (~32 CVEs across 26.6.2/26.6.3, incl. session fixation, redirect-URI bypass, SSRF, refresh-token reuse); also fixes a post-realm-migration exit-code-1 bug in 26.6.x. No KC_* option, port, or endpoint changes.

Chart version fields are intentionally untouched — they are bumped by the release flow.

Closes #81, #82, #84, #85, #86, #88, #89, #90, #91, #92, #93, #94, #95, #96, #97, #98, #99

How to verify

make test        # helm lint + 349 helm-unittest tests — passing locally
dprint check     # formatting — clean
make e2e         # full suite in kind — all 9 scenarios passed locally:
                 #   netbird: sqlite, postgres, mysql, gateway, oidc-keycloak, oidc-zitadel
                 #   keycloak: dev, postgres, replicas

E2e verified peer registration, network map sync, and relay reachability on netbird 0.72.3, and all 8 Keycloak REST API checks plus multi-replica health on 26.6.3.

🤖 Generated with Claude Code

[mikkeldamsgaard]

CI caught a real chart bug in the E2E — Keycloak: Replicas job (failed twice with the same signature): replicas booted as singleton JGroups clusters and merged late (ISPN000517 in the pod logs), so the cache invalidation for a freshly created realm was lost — client creation on the other replica returned 403. Root cause: the JGroups headless service was missing publishNotReadyAddresses: true, so peers were not DNS-resolvable until Ready. Fixed in the second commit, matching what the upstream Keycloak operator does; replicas e2e re-verified locally.