EV-6336: feat(istio): waypoint pull secret support for private registries

[electricjesus]

Description

Jira: EV-6336

When users create an Istio waypoint Gateway (gatewayClassName: istio-waypoint) in their namespace, istiod automatically creates a waypoint Deployment there. On clusters with private registries (like AKS with gcr.io/unique-caldron-775), the waypoint pod fails with ImagePullBackOff because the pull secret only exists in the operator namespace and istiod doesn't inject imagePullSecrets into waypoint pod specs.

This PR fixes the issue with two changes:

Part 1: Pass imagePullSecrets to istiod via Helm values

• Adds ImagePullSecrets field to GlobalConfig in the Istio render package
• Populates global.imagePullSecrets in istiod Helm values from Installation pull secrets
• This makes istiod inject imagePullSecrets references into waypoint pod specs it creates

Part 2: New waypoint sub-controller

• Watches for istio-waypoint Gateway resources across all namespaces
• Copies pull Secret objects from the operator namespace to waypoint namespaces so the references resolve
• Tracks copied secrets with operator.tigera.io/istio-waypoint-pull-secret label for cleanup
• Cleans up stale secrets when gateways are removed or Istio CR is deleted

Both parts are no-ops when no pull secrets are configured (omitempty / early return).

Testing:

• Unit tests for Helm values serialization (render package)
• 8 controller tests covering: no secrets, single/multiple gateways, same/different namespaces, gateway deletion cleanup, non-matching gatewayClassName, Istio CR deletion, and missing Installation
• All existing istio controller and render tests continue to pass

Components affected: pkg/render/istio, pkg/controller/istio, internal/controller

Release Note

Istio waypoint Gateways now work on clusters with private registries. The operator passes imagePullSecrets to istiod via Helm values and copies pull secrets to namespaces containing waypoint Gateways.

For PR author

• Tests for change.
• If changing pkg/apis/, run make gen-files
• If changing versions, run make gen-versions