This PR migrates Network Policy Secret handling to use SDS instead of inlining the secrets inside NPDS.

This has a few advantages:

• Changes to policy Secrets will no longer require a policy recalculation to take effect
• We can use the existing secret syncing functionality to reduce the scope of access that the Agent requires to Secrets (so that it no longer requires access to all Secrets in the cluster for secret use in NetworkPolicy to work)
• Reducing the size of NPDS updates (by not inlining) should hopefully speed up sending this config, and help with memory use at large scale.

Some background on using secrets in NetworkPolicy:

There are two ways you can use a Secret in NetworkPolicy, for TLS interception (both termination and origination), and for storing the value of a header that you want to match or add.

TLS Interception seems to be more common, but both are currently implemented.

One additional piece of functionality that this PR preserves is the ability to read "Secrets" specified in CiliumNetworkPolicy via files on the filesystem of the Agent. This functionality was built when Cilium was more focused on non-Kubernetes use cases, and should probably be deprecated and then removed at a later date. Removing this will substantially simplify the code.

This PR also includes all the requisite Helm changes to track secret syncing (similarly to Ingress, Gateway API, and BGP config), and updates the connectivity tests in cilium-cli to use all the new values and functionality correctly.

It also updates the existing TLS Interception docs for the changes, and makes them so that they work (the example app artii.herokuapp.com is down, this replaces that with httpbin.org.)

Fixes: #24020

Cilium now sends TLS Interception and Header manipulation secrets referenced in CiliumNetworkPolicy and CiliumClusterwideNetworkPolicy by reference using SDS, using the same secret synchronization method used for Ingress, Gateway API, and BGP control plane secrets.

For reviewers, reviewing by commits will definitely be easier for this one.

Sorry about the size, this turned out to be a much bigger change than anticipated.