feat(network): implement ingress network policies

[andrewazores]

Welcome to Cryostat! 👋

Before contributing, make sure you have:

• Read the contributing guidelines
• Linked a relevant issue which this PR resolves
• Linked any other relevant issues, PR's, or documentation, if any
• Resolved all conflicts, if any
• Rebased your branch PR on top of the latest upstream main branch
• Attached at least one of the following labels to the PR: [chore, ci, docs, feat, fix, test]
• Signed all commits: git commit -S -m "YOUR_COMMIT_MESSAGE"

---

Fixes: #1008
See #814
See also cryostatio/cryostat-helm#208

Description of the change:

Mirrors the NetworkPolicy implementation for ingress traffic from the Helm PR above.

Motivation for the change:

Adds network-level isolation to various Pods created by the Operator, so that traffic to each is only allowed from expected origins (assuming the cluster supports this feature). This prevents unexpected connections to the database or storage, which could result in data being leaked if authentication is not configured or is somehow bypassed.

How to manually test:

1. Check out and build PR
2. Deploy, then create a Cryostat CR with 1 reports replica
3. Wait for everything to be reconciled
4. oc describe networkpolicy
5. See other testing steps in Helm PR, ex. use oc run and try to curl requests to http://cryostat-sample-reports:10000 or http://cryostat-sample-storage:8333.

[andrewazores]

/build_test

[andrewazores]

https://github.com/cryostatio/cryostat-operator/actions/runs/12813863402

[github-actions]

/build_test completed successfully ✅.
View Actions Run.

[andrewazores]

/build_test

[github-actions]

/build_test completed successfully ✅.
View Actions Run.