[v3.24] fix(crds): install applicationlayer WAF CRDs in v1-CRD mode

[electricjesus]

Cherry-pick of #4920.

Description

Bug fix.

The applicationlayer.projectcalico.org WAF v3 CRDs (WAFPolicy, GlobalWAFPolicy, WAFPlugin, GlobalWAFPlugin, WAFValidationPolicy, GlobalWAFValidationPolicy) were bundled into the enterprise/v3.projectcalico.org/ datastore CRD source directory, so getEnterpriseCRDSource installed them only in v3-CRD mode. On a standard apiserver-backed install the operator runs in v1-CRD mode, selects the enterprise/v1.crd.projectcalico.org source dir, and skips these CRDs entirely. Because applicationlayer.projectcalico.org is a CRD-only group (the aggregated apiserver serves only projectcalico.org), the kinds are then unavailable and the kube-controllers WAF reconcilers cannot start their informers — so gateway WAF is unusable on any standard install.

applicationlayer.projectcalico.org is a distinct, CRD-only API group with a single v3 schema (not the crd.projectcalico.org ↔ projectcalico.org group rename), so it is now handled the same way as policy.networking.k8s.io: synced into its own CRD source directory (pkg/imports/crds/enterprise/applicationlayer.projectcalico.org/) and installed unconditionally in both v1-CRD and v3-CRD modes via a dedicated getApplicationLayerCRDSource().

• Type: bug fix
• Components: operator CRD management (pkg/imports/crds), CRD sync (Makefile)
• Testing:
  • Unit test asserting the six applicationlayer.projectcalico.org CRDs are present for the Enterprise variant in both v1-CRD and v3-CRD modes.
  • Verified live on a master Calico Enterprise hashrelease running in apiserver-backed (v1-CRD) mode: with the stock operator, zero applicationlayer.projectcalico.org CRDs were installed; with this change the operator installs all six. Re-verified by deleting the CRDs and confirming the operator reinstalls all six via the new code path. Cross-checked against a --no-api-server (v3-CRD) cluster where the CRDs were already present.

Release Note

Fixed a bug where the Calico Enterprise gateway WAF CRDs (applicationlayer.projectcalico.org) were not installed on standard aggregated-apiserver installations, making the gateway WAF feature unusable. These CRDs are now installed in both CRD modes.

For PR author

• Tests for change. — pkg/imports/crds/crds_test.go asserts the WAF CRDs install in both v1-CRD and v3-CRD modes.
• If changing pkg/apis/, run make gen-files — N/A, no pkg/apis/ changes.
• If changing versions, run make gen-versions — N/A, no version changes. (CRD sync layout updated in Makefile so update-enterprise-crds relocates these CRDs to the dedicated dir.)

For PR reviewers

• Milestone set according to targeted release.
• Appropriate labels: kind/bug, enterprise.