Add SeccompProfile to Waypoint proxies

[alexh-tigera]

Allow Waypoint proxies to run in PSA restricted mode.

Release Note

TBD

For PR author

• Tests for change.
• If changing pkg/apis/, run make gen-files
• If changing versions, run make gen-versions

For PR reviewers

A note for code reviewers - all pull requests must have the following:

• Milestone set according to targeted release.
• Appropriate labels:
  • kind/bug if this is a bugfix.
  • kind/enhancement if this is a a new feature.
  • enterprise if this PR applies to Calico Enterprise only.

[Copilot]

Pull request overview

This PR updates the Istio rendering logic in the operator to ensure Waypoint (gateway-style) proxies are configured with a seccompProfile, allowing them to run in Pod Security Admission (PSA) restricted namespaces.

Changes:

• Add gateways.seccompProfile: { type: RuntimeDefault } to the rendered istiod Helm values.
• Extend the Istio values configuration structs to support a gateways stanza.
• Add a rendering test that asserts the sidecar injector ConfigMap values include the expected gateways.seccompProfile setting.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
pkg/render/istio/istio.go	Sets default Gateways.SeccompProfile to RuntimeDefault in istiod values to support PSA restricted environments.
pkg/render/istio/config.go	Introduces GatewaysConfig and wires it into IstiodOpts so the value is rendered into Helm options.
pkg/render/istio/istio_test.go	Adds a test validating the rendered injector ConfigMap contains gateways.seccompProfile.type=RuntimeDefault.