Add OPA sidecar for the coordinator

[tadeha]

Summary

• Adds an Open Policy Agent sidecar to the Trino coordinator pod, configured via a new top-level opa.* values block.
• Auto-wires access-control.properties when opa.enabled=true and accessControl is unset. User-supplied accessControl is respected unchanged, so existing installs are unaffected.
• Adds a helm test (test-opa.yaml) covering both denied and allowed users, and an opa CI scenario in tests/trino/test.sh.
• Bumps the chart version to 1.43.0.

Motivation

OPA is the policy engine behind Trino's OPA access-control plugin.
Until now, operators had to wire it manually via sidecarContainers.coordinator plus accessControl.properties, duplicating logic across deployments. This PR adds OPA as a built-in chart option: users supply a policy, the chart handles sidecar wiring, access-control properties, probes, and security context.

Testing

• helm lint charts/trino and helm lint -f tests/trino/test-opa-values.yaml.
• helm template verified for: default (no OPA), opa-enabled inline policy, opa-enabled with external policyConfigMap, opa-enabled with manual accessControl (auto-wire skipped), and the two failure paths (empty policy → fail, both policy and policyConfigMap set → fail).
• ./tests/trino/test.sh -t opa end-to-end on kind: both test-connection (admin) and test-opa (denied + allowed) pass.

Docs

• helm-docs regenerated.
• See https://trino.io/docs/current/security/opa-access-control.html