SYS-673 envoy gateway with internal root CA issuer

[instantlinux]

Summary of Changes

Adds support for Gateway API, with the open-source Envoy.

• New helm chart infra, which includes a kitchen sink of k8s resources - gateway, cert-manager, k8s-backup, namespace RAM limits, storage, rsyslog, prometheus RBAC
• Move some of the install/*.yaml resource files into infra helm chart, to simplify initial setup
• New internal root CA issuer, for services that can run behind the tailscale VPN
• New implementation for basic-auth of Splunk UI for the free containerized version
• Update the helm release github action: ditched the old github-pages method, it now triggers helm push to both ghcr.io and registry-1.docker.io

Why is this change being made?

Ingress-NGINX support was abruptly and unceremoniously discontinued as of 6 months ago. It's a WHOLE LOT OF WORK, as demonstrated in this PR and successive ones that will have to be applied before discontinuing ingress-nginx in this repo, to replace it.

The dns01 cert solver is fraught with brittleness, as the public https://github.com/gradecam/cert-manager-dns-lexicon-webhook tool just happened to also drop out of maintenance prior to ingress-nginx sunset. So the somewhat complex root-CA internal issuer approach is adopted here, as a more robust method (with the disadvantage of having to periodically extract and distribute a trusted internal root cert to users).

How was this tested? How can the reviewer verify your testing?

Tons of manual testing.

Completion checklist

• The pull request is linked to all related issues
• This change has unit test coverage
• Documentation has been updated
• Dependencies have been updated and verified