Improve CI stability: make kubeconform schema validation resilient to transient download failures

[lhotari]

Motivation

The chart-testing lint job on master is failing intermittently because kubeconform cannot download JSON schemas from raw.githubusercontent.com:

stdin - Role release-name-pulsar-broker-role failed validation: failed downloading schema at https://raw.githubusercontent.com/yannh/kubernetes-json-schema/master/v1.27.0-standalone-strict/role-rbac-v1.json: ... giving up after 3 attempt(s)

Two consecutive attempts of https://github.com/apache/pulsar-helm-chart/actions/runs/28790178682 failed this way (different schema files each time), while all actual chart validation passed (Invalid: 0). The root cause is likely throttling of GitHub Actions runner requests to raw.githubusercontent.com, aggravated by the fact that each kubeconform invocation re-downloads the same schemas: the lint job validates ~21 values files × 10 k8s versions, so the same schema files get downloaded hundreds of times per run.

Modifications

• Cache downloaded schemas with kubeconform's -cache option (new hack::kubeconform_with_retries helper in hack/common.sh), so each schema is downloaded at most once per run.
• Persist the schema cache across CI runs with actions/cache (restore + save split so the cache is saved even when validation fails, avoiding re-downloads on the next attempt).
• Retry kubeconform up to 5 times when the failure is a schema download error. Already-cached schemas are not re-downloaded on retry, so each retry only fetches the missing ones. Genuine validation failures fail immediately without retrying.
• Render helm template output to a file so the kubeconform validation can be retried without re-running helm.

Verification

Tested locally:

• warm cache run performs zero downloads (0.3s vs 2.1s cold per validation)
• unreachable schema host: 5 attempts with 5s backoff, then fails with exit code 1
• invalid resource (-strict violation): fails immediately with no retries