Bump firewall image to 2.3.3 (Helm + CloudFormation)

[Eric Hibbs (flowstate)]

Bumps the default firewall image/chart references from 2.2.0 to 2.3.3.

• helm/Chart.yaml: appVersion 2.2.0 -> 2.3.3, chart version 0.11.3 -> 0.11.4
• cloudformation/firewall-eks.yaml: FirewallImageTag/ChartVersion parameter defaults updated to match
• cloudformation/values/dns-override.values.yaml, helm/values.yaml: pinned image.tag updated
• helm/README.md, cloudformation/README.md: doc references updated to match

2.3.3 fixes intermittent 502s on package downloads and Socket API calls (stale pooled connection retried once on a fresh connection), and exempts OpenVSX extension-gallery traffic (VS Code, Cursor, VSCodium) from the client bearer-token gate, since those editors have no way to supply a custom Authorization header.

Firewall release: https://github.com/SocketDev/socket-nginx-firewall/releases/tag/v2.3.3

Verified locally: helm lint helm/ (0 failures) and helm template helm/ renders image: "socketdev/socket-registry-firewall:2.3.3".

---

Note

Low Risk
Version-pin updates only; behavior changes come from the upstream 2.3.3 image when clusters upgrade, not from modified deployment logic in this repo.

Overview
Bumps default firewall image and Helm chart versions so new installs and CloudFormation handoffs pull 2.3.3 / chart 0.11.4 instead of 2.2.0 / 0.11.3.

Updates are aligned across helm/Chart.yaml (appVersion, version), helm/values.yaml, the EKS example values file, cloudformation/firewall-eks.yaml parameter defaults (FirewallImageTag, ChartVersion), and the matching README docs. No chart templates or stack logic change—only pinned defaults and documentation.

^{Reviewed by Cursor Bugbot for commit c9cac32. Configure here.}