Raise HTTP/2 window on webservice Geo/main ClientTrafficPolicy

What does this MR do?

Raise the HTTP/2 flow-control windows on the webservice section-scoped ClientTrafficPolicy defaults for the main (gitlab-web) and geo (gitlab-web-geo) listeners:

http2:
  initialStreamWindowSize: 8Mi     # up from Envoy Gateway default 64Ki
  initialConnectionWindowSize: 16Mi # up from Envoy Gateway default 1Mi

Why

A single HTTP/2 stream is bound by initialStreamWindowSize / RTT. Envoy Gateway's default initialStreamWindowSize is 64 KiB, which caps one stream to roughly 300 KiB/s at ~200 ms RTT, regardless of available bandwidth.

This hits GitLab Geo: a secondary site proxies git (e.g. push-over-SSH) to the primary as a single HTTP/2 request to the gitlab-web / gitlab-web-geo listeners over a high-latency inter-site link. On a real high-RTT Geo deployment the proxied SSH push was capped at ~300 KiB/s.

Because these are section-scoped policies, they take precedence over the gateway-wide gatewayApiResources.envoy.clientTrafficPolicySpec, so setting the window there has no effect for these listeners — the default must live on the section policy. The values remain overridable via clientTrafficPolicy.<variant>.spec (added in !5183 (merged)).

Validation

On a high-RTT (~200 ms) Envoy Gateway Geo deployment, patching these section-scoped policies to 8Mi/16Mi changed the proxied SSH push from ~300 KiB/s to ~7 MB/s (~24×), with no other changes.

On the values (not set in stone)

8Mi stream window covers ~40 MB/s per stream at 200 ms RTT (8 MiB / 0.2 s), well above typical Geo inter-region link speeds; 16Mi connection window is 2× the stream window so the connection window is never the single-stream limit. These are BDP-based estimates for a ~150–250 ms Geo pair, not a measured optimum — happy to adjust. For reference, Envoy's high-BDP tuning guidance is ~256 KiB–16 MiB and Go's HTTP/2 client defaults its stream window to 4 MiB.

Related

• Closes #6582 (closed)
• Builds on !5183 (merged) (made the webservice section CTP specs overridable) / #6571 (closed)
• Full RCA + on-tenant validation: gitlab-com/gl-infra/gitlab-dedicated/team#13015

Changelog: changed