fix(policy): reject unknown endpoint security modes - #3187

Summary

Make security-sensitive network policy values fail closed across all policy ingress paths. Replace the public TLS, enforcement, and access strings with typed protobuf enums so invalid values cannot silently weaken enforcement.

Related Issue

Closes #3046

Changes

• Added shared validation for endpoint TLS, enforcement, and access values.
• Rejects unknown values with actionable, field-level errors.
• Applies validation across sandbox policies, policy updates, provider profiles, and merge operations.
• Prevents malformed enforcement values such as enforc from falling back to audit mode.
• Added defensive runtime rejection for invalid endpoint modes.
• Returns gRPC INVALID_ARGUMENT before invalid policies are persisted or activated.
• Replaced public protobuf strings for TLS, enforcement, and access with typed enums.
• Updated generated Go bindings and SDK conversions to use the new enum types.
• Preserved the documented YAML spellings for compatibility.
• Added regression coverage across policy, provider-profile, gateway, SDK, and runtime paths.
• Documented accepted values and fail-closed behavior.

Testing

• mise run pre-commit passes
• mise run test passes
• Unit tests added/updated
• E2E tests added/updated (not applicable)
• Manually verified sandbox creation and live policy updates using the Podman gateway
• Confirmed malformed TLS, enforcement, and access values are rejected
• Confirmed rejected updates do not alter the active policy

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)