fix(rbac): derive HUB_EXTERNAL_URL via the hubExternalURL helper

[tylerpotts]

Fixes #185.

Problem

The RBAC bootstrap Job renders HUB_EXTERNAL_URL from .Values.nebariapp.hostname directly, unlike every other consumer which goes through the hubHostname/hubExternalURL helpers (deriving hub.<base-domain> from keycloak.hostname). On zero-config deploys the env var renders as https://; the script's rstrip('/') reduces it to https:, which passes the if not hub_external_url guard, and Keycloak 400s the hub client-URL reconcile — the Job crashloops on every deployment that relies on hostname derivation (observed on a Hetzner k3s deployment; log signature reconciling hub client URLs (rootUrl='https:', ...)).

Fix

One line: default to include "nebari-data-science-pack.hubExternalURL" . | trimSuffix "/" instead of printf "https://%s" .Values.nebariapp.hostname. The helper returns empty when no hostname is derivable, so the script's skip-guard actually engages.

Rendering matrix (verified with helm template)

values	before	after
keycloak.hostname only	https:// -> 400 crashloop	https://hub.<base-domain>
explicit nebariapp.hostname	https://<hostname>	unchanged
explicit rbac.bootstrap.hubExternalUrl	wins	unchanged (still wins)
no hostname derivable	n/a	chart already fails render with its existing clear error; with nebariapp.enabled=false the Job is not rendered at all

helm lint passes.