Fix grafana StatefulSet rendering with extraContainers and a service account

[marcleblanc2]

The grafana StatefulSet template renders serviceAccountName between the containers list and grafana.extraContainers, so setting both a service account and extraContainers produces invalid YAML:

Error: YAML parse error on sourcegraph/templates/grafana/grafana.StatefulSet.yaml: error converting YAML to JSON: yaml: line 94: did not find expected key

This moves the extraContainers block before renderServiceAccountName, matching the ordering every other template uses (e.g. gitserver.StatefulSet.yaml). Grafana is the only template with this misordering.

This fix is required for customers using the Airgapped Analytics dashboard, with AWS IAM (IRSA) authentication to their Postgres database in RDS.

Checklist

• Follow the manual testing process
• Update changelog
• Update Kubernetes update doc — not needed, no user-facing upgrade steps

Test plan

With test values setting both keys:

grafana:
  serviceAccount:
    create: false
    name: grafana-test-sa
  extraContainers:
    - name: test-sidecar
      image: busybox

• Before: helm template sourcegraph charts/sourcegraph -f test-values.yaml fails with the YAML parse error above
• After: renders cleanly; parsed the StatefulSet with PyYAML and verified spec.template.spec.serviceAccountName: grafana-test-sa and containers: [grafana, test-sidecar]
• Verified no other template renders extraContainers after renderServiceAccountName

[sourcegraph-release-bot]

The backport to 7.6.x failed at https://github.com/sourcegraph/deploy-sourcegraph-helm/actions/runs/32339881719:

The process '/usr/bin/git' failed with exit code 1

To backport this PR manually, you can either:

Via the sg tool

Use the sg backport command to backport your commit to the release branch.

sg backport -r 7.6.x -p 924

Via your terminal

To backport manually, run these commands in your terminal:

# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add .worktrees/backport-7.6.x 7.6.x
# Navigate to the new working tree
cd .worktrees/backport-7.6.x
# Create a new branch
git switch --create backport-924-to-7.6.x
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 e8fed45af40538315e049ecf9080ea8d8e5b2494
# Push it to GitHub
git push --set-upstream origin backport-924-to-7.6.x
# Go back to the original working tree
cd ../..
# Delete the working tree
git worktree remove .worktrees/backport-7.6.x

If you encouter conflict, first resolve the conflict and stage all files, then run the commands below:

git cherry-pick --continue
# Push it to GitHub
git push --set-upstream origin backport-924-to-7.6.x
# Go back to the original working tree
cd ../..
# Delete the working tree
git worktree remove .worktrees/backport-7.6.x

• Follow above instructions to backport the commit.
• Create a pull request where the base branch is 7.6.x and the compare/head branch is backport-924-to-7.6.x., click here to create the pull request.

Once the pull request has been created, please ensure the following:

• Make sure to tag @sourcegraph/release in the pull request description.

• kindly remove the release-blocker from this pull request.