Run the k3d Traefik review specs over HTTPS and check KAS endpoints

What does this MR do?

Add a feature spec (spec/features/kas_spec.rb) that checks the agent endpoints KAS advertises (native gRPC, WebSocket and the Kubernetes API proxy) independently of the Ingress or Gateway API controller in front of KAS. It reads the advertised addresses from /api/v4/metadata and only relies on responses that KAS itself produces.

Run the review specs of the k3d Traefik environment over HTTPS, with certificates cert-manager obtains from Pebble through the Ingress HTTP-01 solver, so that agents are pointed at grpcs:// and the Traefik gRPC Ingress from !5448 (merged) is exercised over TLS. The QA job stays on HTTP.

• traefik-https-k3d.values.yaml and a Traefik overlay that exposes websecure with readTimeout: 0.
• useNewIngressForCerts: true, so the HTTP-01 solver Ingresses are served on web while the chart's Ingresses stay on websecure, and certmanager.config.enableGatewayAPI: false, because no Gateway API CRDs exist without Envoy Gateway.
• The cert-manager and trust settings for Pebble move from gatewayapi-https-k3d.values.yaml into a shared pebble-k3d.values.yaml. The rendered Gateway API environment is unchanged.
• verify_certmanager.sh also handles the Ingress issuer and Certificates, and the ingress provider helpers treat an unset toggle as not selected under set -u.

This MR depends on !5448 (merged) because it enables global.kas.ingress.grpc.enabled for the Traefik environment, which needs the chart changes from !5448 (merged).

Related issues

Related to #6659 (closed) and !5448 (merged)

Author checklist

For general guidance, please follow our Contributing guide.

Required

For anything in this list which will not be completed, please provide a reason in the MR discussion.

• Merge Request Title and Description are up to date, accurate, and descriptive.
• MR targeting the appropriate branch.
• MR has a green pipeline.
• Documentation created/updated.
• Tests added/updated.
• Have you validated that your change works end-to-end on a real cluster deployment?
  • Describe how you did it in a comment.
• Equivalent MR/issue for omnibus-gitlab opened.
• When ready for review, MR is marked as ready (not a draft) and assigned to a reviewer.

Reviewers checklist

• As soon as you begin reviewing, select Start a review on your first comment so the MR shows Reviewer started review.
• MR has a green pipeline on https://gitlab.com/gitlab-org/charts/gitlab.
• Consider downstream impact to the Operator, as per evaluating impact from changes to GitLab chart.